Overview

overview

7

Static

static

3

2026-09-16...op.exe

windows10-2004-x64

7

2026-09-16...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    113s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    16/09/2026, 10:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
  • Size 4.8MB
  • Sample260916-m3rfgsaf45
  • SHA256 8b557f9cbb1a0a75a984d4453f66f83f58dcdd1923850b448cc914164c6cfb1a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD83.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2428
      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4124
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10FE.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4116
          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:940
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a141B.bat
              6⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4356
              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:2948
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a16E9.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1368
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:5784
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1999.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4216
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:996
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B7D.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:4600
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:6008
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E4C.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4960
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:236
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a20CD.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:4716
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5584
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24C4.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:3920
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:5288
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D8E.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4832
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Drops file in Windows directory
                                            • Suspicious use of WriteProcessMemory
                                            PID:4204
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a302E.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3468
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:440
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:3616
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:2812
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44CF.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3212
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:828
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4AAB.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3812
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:3056
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C90.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:1092
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2764
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F4F.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:1916
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:1940
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51B0.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1168
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5548
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D2A.bat
                                                                          36⤵
                                                                          • System Location Discovery: System Language Discovery
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:6116
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:4104
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FE9.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2000
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:2212
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62A8.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2940
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2364
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6529.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:1888
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:1212
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a677A.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:2640
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5724
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6865.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3608
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4816
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a693F.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1876
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5328
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A68.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2436
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:928
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B72.bat
                                                                                                          52⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:3160
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:1112
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C5C.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2828
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5908
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DA4.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:572
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:3364
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E8F.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2732
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:704
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FB8.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:4664
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Drops file in Windows directory
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4496
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70A2.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:1116
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:5928
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a71BB.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:5108
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5540
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72D5.bat
                                                                                                                                        66⤵
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:6124
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:3340
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73BF.bat
                                                                                                                                            68⤵
                                                                                                                                              PID:4504
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                PID:2412
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74B9.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:5048
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1084
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75B3.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:1356
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:1176
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76AD.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:1576
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:5788
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7797.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:3384
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:3188
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7891.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                    PID:3296
                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                      79⤵
                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4200
                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a797C.bat
                                                                                                                                                                        80⤵
                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                        PID:4268
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                          PID:3744
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A85.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                              PID:5212
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:3356
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B8F.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                  PID:4760
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    85⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:1216
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C4A.bat
                                                                                                                                                                                      86⤵
                                                                                                                                                                                        PID:1952
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:3276
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D73.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                              PID:6080
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:2884
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E5E.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                  PID:2728
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4928
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F67.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:3304
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4276
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8071.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                            PID:5072
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              95⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                              PID:4484
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a819A.bat
                                                                                                                                                                                                                96⤵
                                                                                                                                                                                                                  PID:4404
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    97⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:2904
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82A3.bat
                                                                                                                                                                                                                      98⤵
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        99⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1336
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a839D.bat
                                                                                                                                                                                                                          100⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:3788
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:2408
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8469.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:1996
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                103⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                PID:2432
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8563.bat
                                                                                                                                                                                                                                  104⤵
                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:3052
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                    PID:2668
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a866C.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                      PID:5124
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        107⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8747.bat
                                                                                                                                                                                                                                          108⤵
                                                                                                                                                                                                                                            PID:4608
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:4212
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8822.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                PID:2032
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  111⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:2088
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a893B.bat
                                                                                                                                                                                                                                                    112⤵
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:6140
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:6104
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A16.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                        PID:4740
                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                          115⤵
                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                          PID:4888
                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B10.bat
                                                                                                                                                                                                                                                            116⤵
                                                                                                                                                                                                                                                              PID:3520
                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                117⤵
                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                PID:4388
                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C0A.bat
                                                                                                                                                                                                                                                                  118⤵
                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                  PID:4828
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    119⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:1008
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CD5.bat
                                                                                                                                                                                                                                                                      120⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:5000
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        121⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:4808
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D90.bat
                                                                                                                                                                                                                                                                          122⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:5816
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            123⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3612
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E8A.bat
                                                                                                                                                                                                                                                                              124⤵
                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                              PID:5056
                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                125⤵
                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                PID:4120
                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F65.bat
                                                                                                                                                                                                                                                                                  126⤵
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:1100
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    127⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                    PID:1164
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9040.bat
                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                        PID:5384
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          129⤵
                                                                                                                                                                                                                                                                                            PID:2448
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a911B.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:4376
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:3376
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91E6.bat
                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:4748
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:4796
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92D0.bat
                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:4016
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        135⤵
                                                                                                                                                                                                                                                                                                          PID:2360
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a93DA.bat
                                                                                                                                                                                                                                                                                                            136⤵
                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                            PID:2936
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94A5.bat
                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                    PID:2040
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                        PID:5492
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9580.bat
                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                          PID:920
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:6112
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a964B.bat
                                                                                                                                                                                                                                                                                                                              142⤵
                                                                                                                                                                                                                                                                                                                                PID:5472
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:5320
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9706.bat
                                                                                                                                                                                                                                                                                                                                    144⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                    PID:5488
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      145⤵
                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                      PID:5976
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97D1.bat
                                                                                                                                                                                                                                                                                                                                        146⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:2852
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                          PID:1900
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a987D.bat
                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                              PID:484
                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                PID:4920
                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9968.bat
                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                  PID:4556
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                    PID:1028
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A33.bat
                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:4188
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                        PID:476
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AFE.bat
                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1560
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:4524
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9BC9.bat
                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                PID:2036
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:5544
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CA4.bat
                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:2456
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                      PID:5668
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D5F.bat
                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:4408
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:4572
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E2A.bat
                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:4800
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                163⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:2856
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EF5.bat
                                                                                                                                                                                                                                                                                                                                                                                  164⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                  PID:4616
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    165⤵
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:5888
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FE0.bat
                                                                                                                                                                                                                                                                                                                                                                                      166⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      PID:1572
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        167⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5616
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0CA.bat
                                                                                                                                                                                                                                                                                                                                                                                            168⤵
                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                            PID:3388
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:4420
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                170⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  171⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA280.bat
                                                                                                                                                                                                                                                                                                                                                                                                    172⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      173⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4860
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA35A.bat
                                                                                                                                                                                                                                                                                                                                                                                                        174⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3288
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            175⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2100
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA406.bat
                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                              PID:956
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4240
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5272
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2288
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA771.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5960
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA82D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1944
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3404
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1332
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA994.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB88.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5748
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC15.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD7C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEC4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFFD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0B8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4584
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB174.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB210.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB2CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB358.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB481.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB54C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB637.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB6F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB77F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB82B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB944.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA1F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA9C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBBD4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD99.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE35.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBED2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC068.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC123.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC21D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC346.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC440.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5656
                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                          2⤵
                                                                                                                                          • Creates a file in the Startup directory
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Enumerates connected drives
                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                          PID:1720
                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                            3⤵
                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                            PID:4904
                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                              4⤵
                                                                                                                                                PID:3252

                                                                                                                                        Network

                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                              Replay Monitor

                                                                                                                                              Loading Replay Monitor...

                                                                                                                                              Downloads

                                                                                                                                              $$a10FE.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a10FE.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 4c06bf28c64f61f44a004b9b4bf47995c09eb3fcb29d8cdea37ef32f16853607
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a141B.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a141B.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 116f6e2ac6a5481a6ad866f02427f11295ea50fc76911a816271ac331e81a8ff
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a16E9.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a16E9.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 673f912b8bb26b02808d74a1d161bfd6cfe013bf6b4e67e33884196df3b965b5
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a1999.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1999.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 9e41081057c387c25d944167328c37051d42342cea8d37d9ab34be69ff167651
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a1B7D.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1B7D.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 80bcaa23064a2f3cf7a785a582c2be5704bd515b9ce8114637353c10ecb55270
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a1E4C.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a1E4C.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 59516784792b07758d9aff6ad0a5b047eb3c41b1294d6c0fbabdd81d2ad7c4a0
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a20CD.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a20CD.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 d401eb42fb033795a1cecab65900a948c7c7a311bfe907a0c32c3d7c9b2f36f6
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a24C4.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a24C4.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 3f3bc04b1a489a745d1041b9ad7a0bf7dc04357ce506f4814bd569ef14314ec9
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a2D8E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a2D8E.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 0d8960c2d8b25ecea2956b3d0659a804c08195b1c85f5c5ad5ec60c0abb04221
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a302E.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a302E.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 09911ddf05bfac8a6ff18c1ed0aa05623cdc78e1204c5af7fb1aca43631eb2cf
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a42CC.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 dae768decf6f321aa6fdc466fae2b95d66326385d19ff09a0637782f3fa6c2a6
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a44CF.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a44CF.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 bf7221a47cb8ac8252ba8592405fe8453f5f5265200f67d30ea7fc6569790217
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a4AAB.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4AAB.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 301bea433a578fa0f7c3ab05608ff5b717b49183be39173b6d05566ed0ac699a
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a4C90.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4C90.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 40c558d63b3be4f9fd2f58661b9bdc2bc403176af86b2f775294bdd2dfb2b2c3
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a4F4F.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a4F4F.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 831666f1df76c9619fca8883e932f3dab890bd22062f57bb8f91e6a90156f036
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a51B0.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a51B0.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 1cc98967f5e8fdd4017dee7a20eb723f884ea774b0c33832c0a3a55a66e13b65
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a5D2A.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5D2A.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 121b0b181e66a904e5a0775174bd786cff84ff896545e5bad5ae9bbfb86a97b3
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a5FE9.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a5FE9.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 c291ce1c66d86dd08ef1b94b07b84e794d8b910ef22d4b714b4af9c5b00a8112
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a62A8.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a62A8.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 79eb50445f2ee100e2e47b8bdfb194b164e0c338d275d9c6de9c719789f31699
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$a6529.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$a6529.bat
                                                                                                                                              • Size 776B
                                                                                                                                              • SHA256 09621515e7644b3b014055ef75895fd9111dd910a87fcbb26497dd131dd35c83
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              $$aD83.bat
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\$$aD83.bat
                                                                                                                                              • Size 775B
                                                                                                                                              • SHA256 035a54fc20b68cb0e43d099d49e0102322ad1058550edad582c583fa15f7c16d
                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 041f1b9b92afddb4949e7cb1ca47e74215359e7c139a9f300f80bf77446eba3b
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 7f01c11c32b324ac98db6cf89450bdd25d6bc9842e4ae9fde9fe79aadf0853af
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 5591d7501953dc6029977a7234aaa008a8abcae79b31ce3d12052dc627219059
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 5421f2278c8cdcdcd04699be751694a9dc09a737a5f700526fc4e3ee3b38abcd
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.1MB
                                                                                                                                              • SHA256 9ad68063e30a63543a6e92506a24fa7c6896441a3f12d62487843c63c269305f
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.6MB
                                                                                                                                              • SHA256 9a0eb592fe418e369585fd310dda06561ca05b18dcf625d11a7217bd61c16290
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 2a1f9fc0a1f3357eb33deae83731dfac88cd60818cf07af4fb719bb1b02f42df
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.7MB
                                                                                                                                              • SHA256 c82c3bca4da4f6ee8244bfa15e53982179482276fbe7d9927a907c0afd760671
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.7MB
                                                                                                                                              • SHA256 6816a48f383c7b017e80b14d16c664543b218fed61ab700f3a74f1d8f0f15e04
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 a28a3a8b3cd8c481776b0b02ad51948a2de695d7338392a1ea71e2d9a8bf2978
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 c113bc579f5cb62b9b649bf758d7b149352a656da69a19f1cf32ab29c0c41066
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.7MB
                                                                                                                                              • SHA256 818d92ae2fd4ff005edb2b2b540581b3970996d573eb5fa02468adbfee09618c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.6MB
                                                                                                                                              • SHA256 00990b86d8f16cda33e519705f1065b049d2ab639313bb54fc5baa0872d7f09a
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.4MB
                                                                                                                                              • SHA256 d13c7dbe75252d96158c62519143346ea27d99f9c4344a03a0d5231913d26f48
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 e088806f79787bd494928b882912ba03243b7a46f1dfee31b9c82bec6080d2ad
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.6MB
                                                                                                                                              • SHA256 dc4bde352ea471d599207e6a68e81f39862a0763967bee35a362f3ef99cf8df3
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.3MB
                                                                                                                                              • SHA256 5b864272eba3279567242eec0c4876485f61b3e3ed1f8f3f9aefe3d4d2cfffbf
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.5MB
                                                                                                                                              • SHA256 19986256c0fd845d79efd63860f3bc8502e1a46cb90f89643df92766bb79151f
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 b1be25433935bd24f87a775bb87968397c0bf73725d4d645613a7c6503f144f7
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\2026-09-16_8b1dd05afbcc1eeac976544e556d7a54_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                              • Size 4.2MB
                                                                                                                                              • SHA256 90204840cd4d243f8552cf72b908b1b3749f0c731780db174eab5adf6c4d3cc7
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              Logo1_.exe
                                                                                                                                              • Path C:\Windows\Logo1_.exe
                                                                                                                                              • Size 32KB
                                                                                                                                              • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                              Submit Download

                                                                                                                                              _desktop.ini
                                                                                                                                              • Path F:\$RECYCLE.BIN\S-1-5-21-560646293-820748483-2532804640-1000\_desktop.ini
                                                                                                                                              • Size 9B
                                                                                                                                              • SHA256 adce21c38863e3719070b76cc57d41c4a6461464168032427c8b59beb6ce354c
                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                              Submit Download

                                                                                                                                              memory/236-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/440-5575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/476-8426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/704-8175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/720-8296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/800-8715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/828-6052-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/928-8155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/940-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/996-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1008-8326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1028-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1084-8205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1112-8160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1164-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1176-8210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1204-8559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1212-8134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1216-8240-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1332-8534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1336-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1392-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1432-8733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1720-8097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1720-1683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1720-8271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1720-2886-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1720-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1900-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/1940-6080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2088-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2100-8492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2212-8120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2288-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2308-8619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2360-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2364-8128-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2408-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2412-8200-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2432-8286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2448-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2544-8703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2580-8510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2588-8721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2600-8673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2616-8577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2668-8291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2748-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2748-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2764-6072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2776-8697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2812-5583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2856-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2884-8250-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2904-8270-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2948-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/2960-8649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3056-6060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3056-8135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3128-8667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3164-8547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3188-8220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3276-8245-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3308-8553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3332-8583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3340-8195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3356-8235-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3364-8170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3376-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3404-8528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3500-8613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3604-8498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3612-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3700-8763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3744-8230-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/3800-8565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4104-8110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4120-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4124-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4176-8727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4200-8225-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4204-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4212-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4240-8504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4276-8260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4324-8776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4324-8782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4336-8625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4372-8571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4388-8321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4420-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4484-8265-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4496-8180-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4524-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4568-8601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4572-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4612-8709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4628-8751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4644-8691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4796-8366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4808-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4816-8145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4836-8769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4860-8486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4888-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4916-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4920-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4928-8255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/4980-8661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5116-8775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5288-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5320-8396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5328-8150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5348-8685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5436-8631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5476-8655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5492-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5528-8637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5540-8190-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5544-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5548-8102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5556-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5572-8607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5584-150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5616-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5668-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5724-8140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5784-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5788-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5808-8739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5824-8679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5868-8643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5888-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5904-8745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5908-8165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5928-8185-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5952-8541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5960-8522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/5976-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6008-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6088-8757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6096-8589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6104-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download

                                                                                                                                              memory/6112-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                              Download