Overview

overview

7

Static

static

3

2026-09-13...op.exe

windows10-2004-x64

7

2026-09-13...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    118s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/09/2026, 08:46

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
  • Size 5.5MB
  • Sample260913-kprg8ahe38
  • SHA256 c530d34f35e780eff61ff93d781b720bd77b3d0b9a6255ff8ca9311cfa7f041c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionspywarestealer

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FE.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:3216
      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3220
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a778.bat
          4⤵
          • Executes a command shell one-liner
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4560
          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:3224
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA5.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1728
              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4536
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1F.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:6068
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:5512
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11D8.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:564
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4596
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14F5.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5060
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:1112
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1812.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:3960
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:2664
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2244.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:5892
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:1496
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2522.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2164
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:4404
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2ED6.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:5348
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:4748
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a336A.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4152
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:1436
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DEA.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5712
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4656
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a406A.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:6012
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4208
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4637.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:6080
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:964
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4898.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1504
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4984
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BB5.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:304
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4116
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E93.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1704
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1792
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57EA.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:3364
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2176
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A2C.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4156
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4648
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D39.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4956
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2496
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF8.bat
                                                                                      42⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1896
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:6120
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6373.bat
                                                                                          44⤵
                                                                                          • System Location Discovery: System Language Discovery
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2920
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3376
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a649C.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4636
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2976
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6586.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:2692
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:2996
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6661.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:236
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5792
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a674B.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:896
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:256
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6845.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3432
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4220
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a693F.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5608
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2960
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A39.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2468
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:5332
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B43.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5632
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:5904
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C5C.bat
                                                                                                                              62⤵
                                                                                                                                PID:3844
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  PID:6020
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D66.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:5164
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:2516
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E60.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:1408
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:2600
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F6A.bat
                                                                                                                                                68⤵
                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4196
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  PID:1288
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7073.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:5504
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      PID:1852
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a718C.bat
                                                                                                                                                        72⤵
                                                                                                                                                          PID:4544
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3704
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7296.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:4644
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:3296
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7380.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:3488
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:6036
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a747A.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                            PID:2712
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              79⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              PID:2076
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75B3.bat
                                                                                                                                                                                80⤵
                                                                                                                                                                                  PID:2056
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    81⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:4300
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76EB.bat
                                                                                                                                                                                      82⤵
                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:1204
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        83⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:5436
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7805.bat
                                                                                                                                                                                          84⤵
                                                                                                                                                                                            PID:5568
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              85⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              PID:4624
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78EF.bat
                                                                                                                                                                                                86⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:5940
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  87⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:5264
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A37.bat
                                                                                                                                                                                                    88⤵
                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        89⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:3636
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B12.bat
                                                                                                                                                                                                          90⤵
                                                                                                                                                                                                            PID:2656
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              91⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:3824
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BFC.bat
                                                                                                                                                                                                                92⤵
                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                PID:4664
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  93⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:4492
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CF6.bat
                                                                                                                                                                                                                    94⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:1164
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      95⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:1696
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DF0.bat
                                                                                                                                                                                                                        96⤵
                                                                                                                                                                                                                          PID:3556
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            97⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:4256
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EFA.bat
                                                                                                                                                                                                                              98⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              PID:6060
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                99⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:2620
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FE4.bat
                                                                                                                                                                                                                                  100⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  PID:4720
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    101⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:2280
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80CF.bat
                                                                                                                                                                                                                                      102⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:2408
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        103⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:2540
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81C9.bat
                                                                                                                                                                                                                                          104⤵
                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                          PID:4104
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:2624
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82F2.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                                PID:2752
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  107⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:4768
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a842A.bat
                                                                                                                                                                                                                                                    108⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    PID:4400
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      109⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5316
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8534.bat
                                                                                                                                                                                                                                                        110⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4524
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          111⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          PID:4776
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a860E.bat
                                                                                                                                                                                                                                                            112⤵
                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                            PID:3348
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:3980
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8728.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                  PID:5416
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    115⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:2428
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8831.bat
                                                                                                                                                                                                                                                                      116⤵
                                                                                                                                                                                                                                                                        PID:5124
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          117⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:6052
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
                                                                                                                                                                                                                                                                            118⤵
                                                                                                                                                                                                                                                                              PID:4588
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                119⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                PID:916
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A35.bat
                                                                                                                                                                                                                                                                                  120⤵
                                                                                                                                                                                                                                                                                    PID:4528
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      121⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:4800
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B1F.bat
                                                                                                                                                                                                                                                                                        122⤵
                                                                                                                                                                                                                                                                                          PID:2152
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:2672
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C29.bat
                                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              PID:5192
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:2648
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D42.bat
                                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:6044
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:3000
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E0D.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:2112
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                          PID:3144
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F27.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:1132
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              PID:2956
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9011.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                PID:5640
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                    PID:2108
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a912A.bat
                                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                                        PID:4396
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:3720
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9224.bat
                                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                                              PID:6140
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                PID:3968
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a930F.bat
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:5816
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    139⤵
                                                                                                                                                                                                                                                                                                                                      PID:3096
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93DA.bat
                                                                                                                                                                                                                                                                                                                                        140⤵
                                                                                                                                                                                                                                                                                                                                          PID:5328
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                            PID:5080
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94B4.bat
                                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:5552
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                143⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3212
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95AE.bat
                                                                                                                                                                                                                                                                                                                                                  144⤵
                                                                                                                                                                                                                                                                                                                                                    PID:3180
                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:3020
                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9689.bat
                                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                                          PID:1356
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            147⤵
                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9783.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4732
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  149⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:2160
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a989C.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:4780
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        151⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:5068
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9996.bat
                                                                                                                                                                                                                                                                                                                                                                            152⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:300
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                153⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1880
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B6B.bat
                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:2364
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C36.bat
                                                                                                                                                                                                                                                                                                                                                                                            156⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1716
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                PID:2652
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D11.bat
                                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                  PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    159⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E1B.bat
                                                                                                                                                                                                                                                                                                                                                                                                      160⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                          PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F15.bat
                                                                                                                                                                                                                                                                                                                                                                                                            162⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:3428
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              163⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                              PID:832
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA00F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3184
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0F9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5656
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA399.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA483.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3928
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA53F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2828
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA61A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7B0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA86B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA946.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABB7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC92.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADDA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB089.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB145.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB387.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB481.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB53D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB637.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB702.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB982.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB28.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBD4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC9F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD7A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF01.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC058.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0F5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC27B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC356.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC421.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC605.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC76D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC828.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC990.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAE7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB93.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC30.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD87.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE33.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEDF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD018.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD0D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD17F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD22B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD373.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD41F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD567.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD603.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD69F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD74B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD855.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4988
                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                  PID:4504
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                    PID:3152
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:4640

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                    $$a11D8.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a11D8.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 a44d47c1c5384aed6e20ccad3ba0cb7ef8f8aa049efa8112922a9a28f27dab99
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a14F5.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a14F5.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 ef7c051ba273bed607283283115a03ae0fa5d22d100f5e67a29c4f3f5d4ea693
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a1812.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a1812.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 52aee2d19db95af45096960538e72ea8cc52d79d437581372cc6a5a662b63350
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a2244.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a2244.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 f2380d9b855ce6f870c50360e1751e67a28b07bedeed087ebb4b4ef4ab705f1b
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a2522.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a2522.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 88fd13819315d223ffdd7b8b5f5fe7efa15dadc3ba9d02f59db888ae8067dd35
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a2ED6.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a2ED6.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 c40a3be058dac67290ef532aae16f1257c055f4032d8b7d48f75dccdd2968df5
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a336A.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a336A.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 e1627a0e58d33fc9a973452bd6c0f772bf2dc5584edc449681d4ef93200c8cc9
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a3DEA.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3DEA.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 b3579b37b717fbc34928240853aa5f8823527221f9720284f1dd8672cd321fee
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a3FE.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a3FE.bat
                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                    • SHA256 0014a0703a1b23cf3d9ced05b55389c418d805e3d8fb1c4492b502f9bd1af073
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a406A.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a406A.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 a821712ecb4a5c2757bf65f4faa22381737ee529dccb163ebb96f1cfbd0b4d98
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a4637.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4637.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 0002d1796e9ebcd9761f5c288966c47479f27c7f0d28586dec9578f277027aa5
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a4898.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4898.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 ff6b416ec7fc5086569a832a9d41f1e301a3eb2c28d37357167dd404d81e79e8
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a4BB5.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4BB5.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 c5c2d5aaed02ca66d65e2aa458d0ae45d0b882804b7ab66fb4a46b59b94de52c
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a4E93.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a4E93.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 e3331d75fdc9412a199e7941f4c665094476d521353af2b25697a5ed61ad0c9b
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a57EA.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a57EA.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 a64a786c7ce7a96bd78a0095c4ca0cf2a8e6605eab622db6b19c303b370edf0d
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a5A2C.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5A2C.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 0aa24e2d6c5bdd5dfd2ee7caf3c94dc8f131b24227ae095edb1b36911f0e3a1d
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a5D39.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5D39.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 621d60c5e7d015a11035eeb3edbe3d4fe8a2d75d77f6b0af34cd45d7b58be413
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a5FF8.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a5FF8.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 cf5f880dfdd4b8447f16775aefd9e8975fcbd23d7b1d465dc20fc8029f592597
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a778.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a778.bat
                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                    • SHA256 7e22f9f715272ddf69a438abfa5efc13ba149f43d2e261db9b1ec928fd2f7d0e
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aAA5.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aAA5.bat
                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                    • SHA256 4700289f119771904d68b482296397bff7ffa300808c4d111243295df74297d4
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aE1F.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE1F.bat
                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                    • SHA256 57ba726e93f7e7022d11f1720d24283a49d9f94e5d0f2cd9e49a2fa9262cffd4
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                    • SHA256 d870c1c97ae1f2ba193a0c5bb97bea93fa325c167de479d02ddf772f8b8b2038
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                    • SHA256 23b3df990d03fc1da6834519650491395d2daf53f7f35b223f0bcc33dfb7879e
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                    • SHA256 071061372e36919676798f85e3da47734bbb666aca9f1e9748dab56aa6a51343
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                    • SHA256 1b81b7a74af16c8380bca5cd62c191f80ba5e4e34f6556211a81f16c44d21047
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                    • SHA256 54b7a83b8ce2b73ece5c1c0dd1bdcab146ef3227d5a4f62ad45ae135c67ae7fc
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                    • SHA256 a8163644babf42d39c5252618ad732eee9df9e844788f16e0b359ba2d85d5318
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                    • SHA256 e4c63984df845a2bc5b6fa5f80cba25febfa0616bfe04e0d49f4e0125df35c21
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                    • SHA256 0dbf489fc87ecd7d8d366c756993d8ee147238129ac3dd606dd0d3447c2c5e96
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                    • SHA256 0c95cfa5879f61495c26d13cb70d69efedf2e19e0883a081bf515ec9644ba3b7
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                    • SHA256 e20ef393f6b8324d811874d1c58643aa9e651f0fdab234abd874cfb39af1a2c0
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                    • SHA256 31a423f09f7a669d54cf44150f8927809e5c9a828629aeb705e8f6dd1934c109
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                    • SHA256 2f7f380c2789997adcfb5b425ffb84a6515bb3460e0f147154b342d2923b9a9c
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                    • SHA256 1d08799c18bc4b40a6b4f7aa10d64e9016f50b4e78f5834691d532827f993f42
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                                                    • SHA256 da2b5d92b081919e41fe1f6dd164c7da720d3ab53712cc9360e129ef1b554112
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                    • SHA256 56873961809a8a9dcbf0447b55cf9c86e559ad6f3a7ab8f9bf0fcb252e2a271c
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                    • SHA256 472efea083bf329801976c05afb9f48cc9d30355a3e7dca37c56a72686b6b64b
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                    • SHA256 09c3510b77ad41f797756f0275a4dc950834916ec04cd004f320f53644b76370
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                    • SHA256 74ac7ef5cea56ea15ebdbca771f033d8631a999afb4c0d08d553d4a084f16f78
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                    • SHA256 649c635f81bc54688a362831fba3a4ebe1d7ff68f427f6a38f84d7f006b5ea34
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-13_ed8b514fcea6c6d95c4620548d35ef96_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                    • SHA256 975dcbb6c530f9e4610c7f2dc0b9e57c2ecfb45287a2ffb0c377cfae06bb3364
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Logo1_.exe
                                                                                                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                    • Size 32KB
                                                                                                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    _desktop.ini
                                                                                                                                                                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-53044966-3830981193-2402648431-1000\_desktop.ini
                                                                                                                                                                                                                                    • Size 9B
                                                                                                                                                                                                                                    • SHA256 91ce508664b3b3a1db2fc772a0b719947694487d2d31329da16f37daa9a4167b
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    memory/256-8134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/468-8722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/832-8431-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/880-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/916-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/940-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/964-6060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/964-8109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1052-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1112-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1168-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1208-8680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1232-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1244-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1276-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1288-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1436-5379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1480-8584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1492-8602-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1496-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1608-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1640-8578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1696-8241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1792-8076-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1808-8747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1832-8596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1852-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1880-8401-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2028-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2076-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2108-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2160-8389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2172-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2176-8084-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2280-8256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2388-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2388-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2396-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2428-8291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2432-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2444-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2496-8102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2516-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2540-8261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2600-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2620-8251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2624-8266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2648-8317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2652-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2664-1840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2672-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2740-8728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2788-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2956-8335-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2960-8144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2972-8819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2976-8119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2980-8753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2992-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2996-8124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3000-8323-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3016-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3020-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3096-8359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3108-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3144-8329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3164-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3212-8371-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3220-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3224-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3248-8620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3296-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3376-8114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3420-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3456-8590-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3508-8843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3548-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3636-8226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3668-8614-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3704-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3720-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3744-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3760-8638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3768-8825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3824-8231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3928-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3968-8353-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3980-8286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4112-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4116-6080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4184-8777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4208-5830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4220-8139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4228-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4256-8246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4264-8741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4300-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4320-8476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4372-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4392-8837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4404-2694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4428-8789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4492-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4504-2532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4504-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4504-8070-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4504-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4504-1844-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4536-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4572-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4596-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4612-8608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4620-8626-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4624-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4648-8094-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4656-5583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4668-8849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4748-3428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4756-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4768-8271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4776-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4788-8710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4800-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4856-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4868-8795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4972-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4984-6072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4996-8759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5036-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5068-8395-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5080-8365-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5092-8783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5100-8482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5168-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5208-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5264-8216-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5264-8221-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5304-8801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5316-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5320-8425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5332-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5436-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5460-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5512-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5536-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5656-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5776-8813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5788-8419-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5792-8129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5856-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5860-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5904-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5956-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6020-8159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6036-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6052-8296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6092-8831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6104-8807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6108-8632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6120-8108-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download