Overview

overview

7

Static

static

3

2026-09-24...op.exe

windows10-2004-x64

7

2026-09-24...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 23:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
  • Size 5.4MB
  • Sample260924-3rm7pas14r
  • SHA256 bad66172911a2fa0298486809c6d39253a8b494e8aadf816e3602cd035e12b50
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4844
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a834.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5960
      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1952
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3B.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:940
          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1956
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0A.bat
              6⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3136
              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3408
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1246.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3644
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • Suspicious use of WriteProcessMemory
                    PID:2988
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1543.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1340
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:256
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1851.bat
                          12⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1636
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:4308
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B9C.bat
                              14⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:5988
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:4260
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E4C.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:2368
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4104
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a28AC.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4084
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:3512
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B3C.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:860
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:1632
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E79.bat
                                              22⤵
                                              • Executes a command shell one-liner
                                              • Suspicious use of WriteProcessMemory
                                              PID:3468
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4268
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3EB5.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4180
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:592
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4210.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:1944
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:5968
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44DF.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:4616
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5804
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49C1.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4972
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1296
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C61.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2724
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5828
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FBC.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5184
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • System Location Discovery: System Language Discovery
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4752
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a525C.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:848
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3112
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CCC.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4440
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:5920
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FCA.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5616
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:944
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62C7.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5100
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3548
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6548.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:1424
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:2644
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6642.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:3620
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5528
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a673C.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:6128
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5128
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6874.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1876
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:2344
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69FB.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2688
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:236
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B05.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:3700
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5880
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C1E.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5364
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2144
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D08.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2784
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:1088
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E02.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2584
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:2968
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EFC.bat
                                                                                                                              62⤵
                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                              PID:3348
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                PID:3476
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FF6.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:5124
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:2488
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70F0.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:2744
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4740
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7229.bat
                                                                                                                                              68⤵
                                                                                                                                                PID:4284
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:3544
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7313.bat
                                                                                                                                                    70⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                    PID:5140
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:1820
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a742C.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:5036
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:5048
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7526.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                            PID:3748
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:2456
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7620.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:5948
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    PID:1120
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76EB.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                        PID:2360
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          79⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:6044
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7805.bat
                                                                                                                                                                            80⤵
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:4288
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:1548
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78DF.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:4404
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:1304
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79E9.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                    PID:5700
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                      PID:3024
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AD3.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:4108
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:5380
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BED.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                              PID:2700
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:3820
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D06.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:1288
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:4216
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DD1.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:3220
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                        PID:4324
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EFA.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:2964
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FE4.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                              PID:2440
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                97⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:4536
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80CF.bat
                                                                                                                                                                                                                  98⤵
                                                                                                                                                                                                                    PID:3852
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4564
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D8.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1204
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          101⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:772
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82B3.bat
                                                                                                                                                                                                                            102⤵
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:2612
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:3040
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a838E.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:5608
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  105⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                  PID:3904
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8459.bat
                                                                                                                                                                                                                                    106⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:2556
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      107⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:3736
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8514.bat
                                                                                                                                                                                                                                        108⤵
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:3604
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          109⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                          PID:2912
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a862E.bat
                                                                                                                                                                                                                                            110⤵
                                                                                                                                                                                                                                              PID:4976
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                111⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:5488
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8708.bat
                                                                                                                                                                                                                                                  112⤵
                                                                                                                                                                                                                                                    PID:572
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      113⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      PID:692
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88DD.bat
                                                                                                                                                                                                                                                        114⤵
                                                                                                                                                                                                                                                          PID:5424
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            115⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:2804
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A25.bat
                                                                                                                                                                                                                                                              116⤵
                                                                                                                                                                                                                                                                PID:4092
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  117⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  PID:5560
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B1F.bat
                                                                                                                                                                                                                                                                    118⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                    PID:1628
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      119⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:3340
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8BCB.bat
                                                                                                                                                                                                                                                                        120⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:1700
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          121⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:5064
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C77.bat
                                                                                                                                                                                                                                                                            122⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:3352
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              123⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:5088
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D33.bat
                                                                                                                                                                                                                                                                                124⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:2840
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  125⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:4568
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DEE.bat
                                                                                                                                                                                                                                                                                    126⤵
                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:5892
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      127⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      PID:1612
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EB9.bat
                                                                                                                                                                                                                                                                                        128⤵
                                                                                                                                                                                                                                                                                          PID:4968
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            129⤵
                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                            PID:4336
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F75.bat
                                                                                                                                                                                                                                                                                              130⤵
                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:2712
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                131⤵
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:2452
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a905F.bat
                                                                                                                                                                                                                                                                                                  132⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  PID:3132
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                    PID:3128
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a910B.bat
                                                                                                                                                                                                                                                                                                      134⤵
                                                                                                                                                                                                                                                                                                        PID:4732
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          135⤵
                                                                                                                                                                                                                                                                                                            PID:2960
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91B7.bat
                                                                                                                                                                                                                                                                                                              136⤵
                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                              PID:4496
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                137⤵
                                                                                                                                                                                                                                                                                                                  PID:2728
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92B1.bat
                                                                                                                                                                                                                                                                                                                    138⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                        PID:2204
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a937C.bat
                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:6064
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            141⤵
                                                                                                                                                                                                                                                                                                                              PID:3920
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9437.bat
                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                  PID:3056
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    143⤵
                                                                                                                                                                                                                                                                                                                                      PID:3200
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a94E3.bat
                                                                                                                                                                                                                                                                                                                                        144⤵
                                                                                                                                                                                                                                                                                                                                          PID:2352
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            145⤵
                                                                                                                                                                                                                                                                                                                                              PID:5704
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95BE.bat
                                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:4664
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  147⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2972
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a966A.bat
                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:1084
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                        PID:2388
                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9725.bat
                                                                                                                                                                                                                                                                                                                                                          150⤵
                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                          PID:4644
                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                            151⤵
                                                                                                                                                                                                                                                                                                                                                              PID:2004
                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                                                                                                                                                                                                                                                                                                152⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:5956
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                    PID:2288
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98AC.bat
                                                                                                                                                                                                                                                                                                                                                                      154⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:3972
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:4964
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9968.bat
                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                              PID:1936
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                157⤵
                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                PID:5152
                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A33.bat
                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:5672
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                      PID:4484
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9AEE.bat
                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:5596
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:6032
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                162⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    163⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C65.bat
                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:5808
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                        PID:4416
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CF2.bat
                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:4480
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E59.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2096
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4876
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4980
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2448
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FD0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2092
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA07C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2340
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA128.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:364
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2776
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1F3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2928
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4388
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA35A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:240
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3F7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA493.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA52F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA762.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA80E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA994.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAFC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aABC7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4160
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD2E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aADCA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF12.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5780
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAFAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB05B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB106.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB27D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB31A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB3E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB481.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB51D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB5BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB656.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB711.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB7AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB869.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB9A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA3E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAF9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCED.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD8A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBEF1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF9D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC029.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0C6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC152.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC1EF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC27B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC327.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC431.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC4BD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC55A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC605.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC682.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6FF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC78C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC828.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8C5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC970.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA0D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB55.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBE1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3412
                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                  PID:5440
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                    PID:4516
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                        PID:3548

                                                                                                                                                                                                                Network

                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                      $$a1246.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1246.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 dd5cc1f96745cc300b41f68bd5352adb394c5280d6c5e037498adf304c035261
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a1543.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1543.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 d7f8a6167dfcd5c3f5975ed90643ec7834476813ca9e6ab4777b82594987c691
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a1851.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1851.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 f39f1026df5118c9ab7bfeb3b81ec12d5cf68929ecd08c88746406967092d779
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a1B9C.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1B9C.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 c2b0f4c57695cc137a3032d0928dd61cb1cac58121a89d2e472148010f1c108a
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a1E4C.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a1E4C.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 a482ba797ca07f0dea98b7cbcb7e08489847326b7dca943c5df57716129e9840
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a28AC.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a28AC.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 404329e6823b57484536b964ae03bac0486212c0c9677b278b42b3fda051c92c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a2B3C.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2B3C.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 6f08a229bac53e24e35ff4f516576ed3029bf89de7ea429709b83debc5019c21
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a2E79.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a2E79.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 9b426f52f06390451ce72649f08a5c0371a57dacbde689e591144dbcb61cb743
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a3EB5.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a3EB5.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 56169772cfaa752526b6a6de94db74d11049d39f2ecdf98c42f459e6cbd45d1d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a4210.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4210.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 1c7a0246ad9260ad1f9f108f94ca64351c8a0065a7d4d325898d96cb54d5f7c0
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a44DF.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a44DF.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 d3cf38fb2f6cafac39dd65109c8e08850d0734947cf05ffe0b28f3f684275466
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a49C1.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a49C1.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 77bd60005608ad633c3113e8112947cc8ae96be452375ac8ca0804d373e53415
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a4C61.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4C61.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 fbbf4c33c060b1d5dfbb8b9f0a4d18df0b618cf683bf7217f4baa5580d44ad80
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a4FBC.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a4FBC.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 7c3e7361ab2612bf1038ad7a6791b53a6c8c62edd2a0349d41ab08e0e292911e
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a525C.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a525C.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 078756349fe449ec8700be3c6c1b7ad9d66502e903afb7fe601d68ec15dfc675
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a5CCC.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5CCC.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 4178e31e4c6360a7bffe3cb77da0703ed26a4e4373a88525a2ad55af96034243
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a5FCA.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a5FCA.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 da34354ac7b5071ed4d74c32fcf4146c78bf2bab257fe3b204d6cb33588e65d6
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a62C7.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a62C7.bat
                                                                                                                                                                                                                      • Size 776B
                                                                                                                                                                                                                      • SHA256 7888e72f555aaa0f336e2970278bc8ed7b71dc3a8e814517259e0a85bf5e6575
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$a834.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$a834.bat
                                                                                                                                                                                                                      • Size 775B
                                                                                                                                                                                                                      • SHA256 d583fdf59c17710e879c3b6c36e2b7ac361813fc932af676fc2a5c9bf0292c6c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aC3B.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aC3B.bat
                                                                                                                                                                                                                      • Size 775B
                                                                                                                                                                                                                      • SHA256 4eb354f361d01496829559eb10832669139bae40bca0dab324ae30e52e8837ef
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      $$aF0A.bat
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\$$aF0A.bat
                                                                                                                                                                                                                      • Size 775B
                                                                                                                                                                                                                      • SHA256 66c923eb40ab963c14fe976dd54a27309df438351494a833911b1f3504d0738d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                      • SHA256 5595bf7522cb69e2ec2757e2854ac7ffbcbb99573643de8b9ebea9ce45f62449
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.9MB
                                                                                                                                                                                                                      • SHA256 3c22e3687e8d7a4f433458bb574a0fb83e83e47cccb3f3b14a1043a775a11144
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                                                      • SHA256 4ae2ed5041644a15aff5604be66b21236b601a5aac0983749b343c1309f2c422
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                                                      • SHA256 b8e883d8486ddefe07096166a990eca7e5f0321927b2ff51f8026af014d3d954
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.9MB
                                                                                                                                                                                                                      • SHA256 6f3c040624e770bb4769917cf0dcb3ce0ec1049702e4c7233c3b6d1f7b0c67fa
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.8MB
                                                                                                                                                                                                                      • SHA256 fdba4a30857980c562e263486eeb38e96aa29f4a8fcca30784372b84b2dab51f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.7MB
                                                                                                                                                                                                                      • SHA256 8484564791afabda462840e38c278db0ab49c33b98f03dcec558b9403317c419
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 4.9MB
                                                                                                                                                                                                                      • SHA256 4cf1c7b6e565ee357f7948ea88ae0026b3a22155c425e582344d24ca755b3483
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                      • SHA256 627593003d245bb73da61e645a7b5e11f746302f03ff442041f4809438c58bcc
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                      • SHA256 839466309e57773b92e89e560bf259af757983d92f8e158670a062bddb527d2f
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.1MB
                                                                                                                                                                                                                      • SHA256 c9d850a71e2cb872a5a39c5cb98634feb015921f25953b75b2e855ccef539507
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                      • SHA256 d375401fdb07bc0c9410692e05c8f1adb89607507407a60f57650078a009a0ca
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                      • SHA256 e039917821d620efe7f9eb989d1f21b36120b1149eb37de75ce549f689716d28
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                      • SHA256 b0d9dff6edef505b4f187894ec01571488c72daf5203598e80bedbf3ef23433e
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                      • SHA256 e4f53e812d09d90f29340a21721bec6fe0b25ab41130db8a8c0fcd1982990184
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.1MB
                                                                                                                                                                                                                      • SHA256 f8a1d16dee39c57ec990d82398cc875219b7f1824569229de210f4c537217232
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.3MB
                                                                                                                                                                                                                      • SHA256 24f0ea2abdbbdc298c24b68d8cc6a374969fc6831ace2a96c532f17e1bce81d3
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.1MB
                                                                                                                                                                                                                      • SHA256 bfb5667745cff72f90bddbfe09c45746bd51963c5d22494578a05bfd1b559c0d
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.2MB
                                                                                                                                                                                                                      • SHA256 0eaf6e0c80b5984bb2edb56d4986b611f20479f0d5992e3075bbffc19f590a5c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_c1366d4e5ed463d70f5d2c831ccf10a2_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                      • Size 5.0MB
                                                                                                                                                                                                                      • SHA256 61ad05ce6e659d8651f1be8e608885115e16f8299d7e400cd9b7e18ce8e1435b
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      Logo1_.exe
                                                                                                                                                                                                                      • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                      • Size 32KB
                                                                                                                                                                                                                      • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      _desktop.ini
                                                                                                                                                                                                                      • Path F:\$RECYCLE.BIN\S-1-5-21-2251218687-1689653882-3767565116-1000\_desktop.ini
                                                                                                                                                                                                                      • Size 9B
                                                                                                                                                                                                                      • SHA256 1020704fe83c7e64802b1428d9e5641e37d7c7eef9077c5ed54d2d7974c3c891
                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                      memory/236-8251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/240-8613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/256-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/436-8662-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/592-5583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/692-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/756-8908-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/772-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/944-8220-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1060-8698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1088-8266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1116-8980-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1120-8311-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1296-6068-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1304-8326-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1548-8321-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1612-8439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1616-8758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1632-1883-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1784-8878-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1820-8296-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1924-8914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1952-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/1956-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2004-8511-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2020-8842-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2080-8764-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2092-8583-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2104-8625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2144-8261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2152-8974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2184-8854-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2204-8475-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2288-8517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2340-8589-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2344-8246-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2348-8818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2364-8824-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2388-8505-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2448-8577-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2452-8451-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2456-8306-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2488-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2496-8565-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2500-8920-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2552-8950-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2644-8231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2692-8644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2728-8469-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2776-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2804-8407-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2844-8800-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2912-8392-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2952-8938-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2960-8463-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2964-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2968-8271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2972-8499-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/2988-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3024-8331-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3032-8956-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3040-8377-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3112-8202-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3128-8457-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3148-8770-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3200-8487-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3212-8547-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3304-8794-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3340-8417-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3368-8926-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3408-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3476-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3512-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3540-8776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3544-8291-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3548-8226-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3688-8806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3696-8710-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3724-8890-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3736-8387-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3820-8341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3904-8382-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/3920-8481-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4076-8944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4104-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4132-8746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4148-8680-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4160-8692-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4216-8346-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4248-8860-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4260-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4268-5541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4308-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4324-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4336-8445-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4388-8601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4392-8830-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4396-8812-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4416-8553-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4480-8559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4484-8535-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4536-8362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4540-8962-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4548-8968-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4564-8367-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4568-8433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4596-8836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4640-8932-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4660-8674-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4708-8740-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4740-8286-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4752-6090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4756-8716-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4844-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4844-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4856-8656-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4876-8571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4880-8872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4892-8788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4944-8752-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/4964-8523-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5032-8650-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5048-8301-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5064-8422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5088-8427-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5128-8241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5152-8529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5244-8686-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5276-8734-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5348-8607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5380-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5384-8884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5412-8704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5440-2489-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5440-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5440-1308-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5440-7762-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5440-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5468-8668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5488-8397-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5520-8632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5528-8236-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5560-8412-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5632-8848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5676-8722-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5692-8638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5704-8493-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5784-8728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5796-8619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5804-6060-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5828-6080-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5852-8902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5880-8256-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5920-8210-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5932-8866-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/5968-5591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6032-8541-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6044-8316-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6072-8896-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download

                                                                                                                                                                                                                      memory/6124-8782-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                      Download