Overview

overview

7

Static

static

3

2026-09-23...op.exe

windows10-2004-x64

7

2026-09-23...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    125s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 10:18

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
  • Size 5.6MB
  • Sample260924-mcec8sbb72
  • SHA256 b792137259a02191a2fb4c30277d4b16c38978563558ae320507d7ec663e8600
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 21 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5740
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC922.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:5552
      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4064
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC7E.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:2664
          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2636
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD056.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4072
              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:5384
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD298.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:5512
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:5824
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD548.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:3192
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:456
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD816.bat
                          12⤵
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:5092
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:2372
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAE5.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:4844
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Drops file in Windows directory
                                • Suspicious use of WriteProcessMemory
                                PID:960
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDB4.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:1000
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:2644
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE47A.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3896
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:2024
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE8B0.bat
                                          20⤵
                                          • System Location Discovery: System Language Discovery
                                          • Suspicious use of WriteProcessMemory
                                          PID:4076
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious use of WriteProcessMemory
                                            PID:1032
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEB31.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1516
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4248
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEF09.bat
                                                  24⤵
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4144
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3276
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF785.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:3488
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Drops file in Windows directory
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1764
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE3C.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:2768
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:6060
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a197.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5948
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:476
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a428.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5108
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:2608
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a919.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:1452
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4800
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA4.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4264
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2612
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE98.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1092
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:4904
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11D4.bat
                                                                                  40⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:5776
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:1128
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1A40.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:5436
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3320
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BF5.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4784
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3560
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D0F.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:2992
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4404
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1E09.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:1484
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:356
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F32.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:1344
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:5492
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1FED.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2972
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Drops file in Windows directory
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3816
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2116.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2356
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:1668
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21E1.bat
                                                                                                                  56⤵
                                                                                                                  • Executes a command shell one-liner
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3184
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:204
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22CB.bat
                                                                                                                      58⤵
                                                                                                                      • Executes a command shell one-liner
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3044
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:4192
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23A6.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:5664
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:3752
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2491.bat
                                                                                                                              62⤵
                                                                                                                                PID:5644
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:5744
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a255C.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:5528
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5576
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2627.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        PID:4544
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          PID:1280
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2702.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:1656
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              PID:5932
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27EC.bat
                                                                                                                                                70⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2360
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4424
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2898.bat
                                                                                                                                                    72⤵
                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                    PID:3316
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      73⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      PID:4752
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2953.bat
                                                                                                                                                        74⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:2692
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          75⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                          PID:2588
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A2E.bat
                                                                                                                                                            76⤵
                                                                                                                                                              PID:5952
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                77⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                PID:4036
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B18.bat
                                                                                                                                                                  78⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  PID:4848
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    79⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:1240
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2BE4.bat
                                                                                                                                                                      80⤵
                                                                                                                                                                        PID:2436
                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                          81⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                          PID:5164
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CAF.bat
                                                                                                                                                                            82⤵
                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                            PID:4572
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              83⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:4044
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D5B.bat
                                                                                                                                                                                84⤵
                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                PID:4216
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  85⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                  PID:2484
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E74.bat
                                                                                                                                                                                    86⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:2528
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      87⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:2948
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F7D.bat
                                                                                                                                                                                        88⤵
                                                                                                                                                                                          PID:6104
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            89⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:5988
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3087.bat
                                                                                                                                                                                              90⤵
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:4796
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                91⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:3700
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3152.bat
                                                                                                                                                                                                  92⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:1672
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    93⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:3564
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31FE.bat
                                                                                                                                                                                                      94⤵
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:1320
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        95⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:5260
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32AA.bat
                                                                                                                                                                                                          96⤵
                                                                                                                                                                                                            PID:3728
                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                              97⤵
                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                              PID:2352
                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3385.bat
                                                                                                                                                                                                                98⤵
                                                                                                                                                                                                                  PID:4476
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    99⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:700
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3450.bat
                                                                                                                                                                                                                      100⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:2020
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        101⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:2036
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a350B.bat
                                                                                                                                                                                                                          102⤵
                                                                                                                                                                                                                            PID:3028
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              103⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              PID:4856
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35B7.bat
                                                                                                                                                                                                                                104⤵
                                                                                                                                                                                                                                  PID:1476
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    105⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                    PID:4708
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36A2.bat
                                                                                                                                                                                                                                      106⤵
                                                                                                                                                                                                                                        PID:848
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          107⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:2656
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a376D.bat
                                                                                                                                                                                                                                            108⤵
                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                            PID:4164
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              109⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              PID:4860
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3819.bat
                                                                                                                                                                                                                                                110⤵
                                                                                                                                                                                                                                                  PID:2776
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    111⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:6048
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38C4.bat
                                                                                                                                                                                                                                                      112⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:3544
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        113⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:4664
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3970.bat
                                                                                                                                                                                                                                                          114⤵
                                                                                                                                                                                                                                                            PID:2444
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              115⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              PID:3520
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A1C.bat
                                                                                                                                                                                                                                                                116⤵
                                                                                                                                                                                                                                                                  PID:1628
                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                    117⤵
                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                    PID:5072
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3AC8.bat
                                                                                                                                                                                                                                                                      118⤵
                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                      PID:6120
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        119⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:3596
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B64.bat
                                                                                                                                                                                                                                                                          120⤵
                                                                                                                                                                                                                                                                            PID:3492
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:4956
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3C01.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                  PID:5820
                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                    123⤵
                                                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                                                    PID:2560
                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CDB.bat
                                                                                                                                                                                                                                                                                      124⤵
                                                                                                                                                                                                                                                                                        PID:3412
                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                          125⤵
                                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                                          PID:1492
                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DB6.bat
                                                                                                                                                                                                                                                                                            126⤵
                                                                                                                                                                                                                                                                                              PID:1420
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                PID:5220
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E91.bat
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                  PID:2448
                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                    129⤵
                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                    PID:2516
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F9A.bat
                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                        PID:624
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4046.bat
                                                                                                                                                                                                                                                                                                              132⤵
                                                                                                                                                                                                                                                                                                                PID:4968
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  PID:468
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4140.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                    PID:244
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                      PID:5728
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a421B.bat
                                                                                                                                                                                                                                                                                                                        136⤵
                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                        PID:4576
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                            PID:2744
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42F6.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                                PID:1504
                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                  139⤵
                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                  PID:2752
                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a43E0.bat
                                                                                                                                                                                                                                                                                                                                    140⤵
                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                    PID:1044
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      141⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:5216
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44AB.bat
                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                          PID:2936
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            143⤵
                                                                                                                                                                                                                                                                                                                                              PID:2780
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45A5.bat
                                                                                                                                                                                                                                                                                                                                                144⤵
                                                                                                                                                                                                                                                                                                                                                  PID:5660
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    145⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    PID:2912
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4670.bat
                                                                                                                                                                                                                                                                                                                                                      146⤵
                                                                                                                                                                                                                                                                                                                                                        PID:2640
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          147⤵
                                                                                                                                                                                                                                                                                                                                                            PID:3328
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a471C.bat
                                                                                                                                                                                                                                                                                                                                                              148⤵
                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                              PID:2332
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                PID:4924
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47E7.bat
                                                                                                                                                                                                                                                                                                                                                                  150⤵
                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:792
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:2896
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48E1.bat
                                                                                                                                                                                                                                                                                                                                                                        152⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:3240
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          153⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:4200
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a498D.bat
                                                                                                                                                                                                                                                                                                                                                                            154⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                155⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:3400
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A87.bat
                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:3592
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4304
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B33.bat
                                                                                                                                                                                                                                                                                                                                                                                            158⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:4288
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              159⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              PID:5376
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:4180
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                    161⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:4184
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CE9.bat
                                                                                                                                                                                                                                                                                                                                                                                                      162⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2452
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                        163⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DA4.bat
                                                                                                                                                                                                                                                                                                                                                                                                            164⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E7F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                    166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4432
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                      167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1940
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F5A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5044.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1904
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                            173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2672
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a519C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4116
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5267.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                      176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5351.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3308
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a540D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5593.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2824
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a567E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5759.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5843.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a592D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A47.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B02.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5BCD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C89.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D73.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E2F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:6032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a615B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6207.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62C2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a638E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6439.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6514.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6870.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a694A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69F6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AB2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C29.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6CC5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D52.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DEE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6E9A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6F26.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FB3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a705F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70EB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7178.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7205.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3792
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a735C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7550.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a765A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7716.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77C1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a786D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a790A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a79A6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A61.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7AFE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7BD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C94.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DAD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E69.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FC0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a806C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8108.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8195.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8241.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a82CE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8399.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8445.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84D1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a855E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5956
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85FA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1076
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8687.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8704.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2012
                                                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • Creates a file in the Startup directory
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:4548
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:2388
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:4956

                                                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                                                    $$a11D4.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a11D4.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 abe8759d2f766d4d490a9bd964765c12dc03e5ba849a2db41db91ad1f4fa66c1
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$a197.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a197.bat
                                                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                                                    • SHA256 b98fc7a3162973347dac3f0d2ae0face21935fbde754b0787d80609646d60a11
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$a1A40.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a1A40.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 75daf173c2bb9a892d435b2066f9490eede0ca511cebd1c7e139d56b31d81af3
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$a428.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a428.bat
                                                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                                                    • SHA256 32afab92d6ed85add7a5c9508bd69e9b24506b32829d3039b6ace2af9a9a2ef3
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$a919.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a919.bat
                                                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                                                    • SHA256 a7958f6f9461e4c1c091ed7dda2a46b4fb89fe53755dea5d78a867416ecd5705
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aC922.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC922.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 00888cb58209ec079d657487e6c46f65d840b40e9fa4e5f377f92afc97025d86
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aCA4.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCA4.bat
                                                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                                                    • SHA256 0d2bca8e46276cce8a397faac5104a481fc7129e36eefc0bcbb5cb5e49378ff2
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aCC7E.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCC7E.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 03c9c03f1a5714adb9679837596664fdeea78811d0dcf869922b0a469191d620
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aD056.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD056.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 6660a65e97f03d5221a601e3513f1b48d668d2605b54d20ff5a4c8ecc32a550f
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aD298.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD298.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 bbbd7b4f2a0370d1f76e2167249c590ff888db2fb0e124b6f38091b0f46684f9
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aD548.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD548.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 9183ec6895157d181228fb39cbcbf3f992db6169fe3c469f331ba392cdad0d84
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aD816.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD816.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 75d31d8879b9c0d2675db567376312a1aabcc49897e834e9413781c6260d17ee
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aDAE5.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aDAE5.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 f094df5335719097b03485ae596b40a3b9c09bdcd31f2af9ec69456653d0a07e
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aDDB4.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aDDB4.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 428fac89ea96eebef1dfbd021009293e03b0d3bbbfa5111d55de759a1bc29dc1
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aE47A.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE47A.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 7967b97eadd4c491381a50192643461f61ab21460be552ab102625b1092f5962
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aE8B0.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE8B0.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 059adb6f2aadb2799ff61dd679efa58daae51b6c90f8a95c010a2f421adbd6de
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aE98.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE98.bat
                                                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                                                    • SHA256 2cbdeb0076ec9ad8c0cd819261847935c0b3188298d31115bf2292074de02dae
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aEB31.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aEB31.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 8b87249815abf510ca08ea2943f73190e2514706075f0d2d22a121ee3631c357
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aEF09.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aEF09.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 c264ce9b187283fc9cf2d8aca71efc039d19413e1f7cbb1053feef650aa58919
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aF785.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aF785.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 d1bfafec1255aac22937e8fa6f1f5879d0578bd3da3554641eaa7d46486994c5
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    $$aFE3C.bat
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aFE3C.bat
                                                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                                                    • SHA256 a593c4776d8672eaf2a5c50b5f50874a98701d469cf6c3382fc401466c52de66
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                                    • SHA256 7e26c90973d0be4eeb9d21189ec3fb36cf05595963549d97394be36ec2e05fbd
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                                                    • SHA256 a1ceecfea6800b141eb6b96337fa7cae66ae48812ca1e5067c72e22b946501ed
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                                    • SHA256 79f412babe87184eebd54d861a08b3ec97e07d3f5e34544031fb22ac96eec0b0
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                                    • SHA256 9ad51107693c1e9b07f58a89b71af8717cc69f2b37e250598ad1d975bbccc65a
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                                    • SHA256 898a0cf6cd1eb8045caa290edce0ae5e4de4fdaf62c91e34ba6daaaf4ed6a377
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                                                    • SHA256 b5e5de66e1add1e8fbdf84986d8f30746bb031faaa079a88642d3d658618de6b
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                                                    • SHA256 51ac59889fda63c39bfe19bb23066f2918f0e6217052fbe76bf40066182cfb6c
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                                                    • SHA256 2859f8b331291f17514f9d4e9bb559ad8fd3601dcac7b6bc6682c3751e10284e
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                                    • SHA256 d3933fcd3acfe0bffdae74c3ab694d3a1dbe11b69d9a5791b732b48146d09e4e
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                                                    • SHA256 434d9c3531bc6354e90a2a4c1fbc7001fe99e88fe18958dd061be108bcdbfd18
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                                                    • SHA256 99d0b62d23fc8b83f726624f27e39c8655097eb99759f2b43dc3f8e890afa3ba
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.6MB
                                                                                                                                                                                                                                                                    • SHA256 89909bb70b00294d934e6158f3e89d05ed64ebcc5a2cba7d3fc602114e301b22
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                                                                                    • SHA256 0ae623e3d0f01b2138c20d3f5c75a6e14b764c9882bd096dc168c4dc685a9b45
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                                                                                    • SHA256 4a8135fa9e412a16e2d0dedb6ef4f7a0e738073793cb728505e442a13bfa4674
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.5MB
                                                                                                                                                                                                                                                                    • SHA256 b04bda7ae8fb373293f53fc5e7a2d1b26b1e227ade9f0cf996a38e466ceb8f6a
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                                                    • SHA256 70041d6461c556c46473d074ea35346e1c133713f1440381f39ba1df93989159
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                                                    • SHA256 4b7da7d80b54bb16351f952957697c7e7040c72870c4c59eb77a5950b387839f
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                                                    • SHA256 27e8949d562ff8163f820ffbd1d5923bc74ce07140ce2cf7322db1c3bfb4380b
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                                                    • SHA256 ffb418be9ca9b50bff74688b8c59fe8e4a30657832414a6f18fc27fd8a1b2795
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-23_3e774e692517194abfcb1a757eba0dbd_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                                                    • SHA256 11f65519f0dd5550b79c5eff426967dbf4d5f9bf05eef3c13e42b5dc20e6870c
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    Logo1_.exe
                                                                                                                                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                    • Size 32KB
                                                                                                                                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    _desktop.ini
                                                                                                                                                                                                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-461973139-3212354679-1508698038-1000\_desktop.ini
                                                                                                                                                                                                                                                                    • Size 9B
                                                                                                                                                                                                                                                                    • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                                                    memory/204-8129-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/356-8109-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/456-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/468-8324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/476-5609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/700-8234-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/708-8649-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/720-8769-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/812-8601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/960-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1032-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1048-8420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1052-8480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1060-8781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1128-8086-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1152-8558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1240-8184-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1268-8595-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1280-8154-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1336-8504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1384-8775-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1492-8299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1524-8643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1576-8799-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1648-8847-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1668-8124-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1724-8751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1764-5102-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1796-8673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1832-8552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1840-8486-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1904-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/1940-8426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2024-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2036-8239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2080-8516-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2140-8763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2216-8498-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2220-8757-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2352-8229-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2372-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2440-8588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2484-8199-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2488-8546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2516-8312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2560-8294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2588-8174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2604-8607-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2608-6078-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2612-6098-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2620-8613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2636-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2644-1072-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2656-8254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2668-8564-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2672-8444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2744-8336-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2748-8805-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2752-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2780-8354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2844-8318-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2864-8655-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2896-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2912-8360-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2944-8637-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2948-8204-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/2960-8619-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3100-8817-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3164-8727-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3168-8685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3180-8661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3196-8456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3276-3677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3320-8092-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3324-8414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3328-8366-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3400-8390-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3408-8570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3468-8679-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3476-8510-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3484-8715-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3500-8534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3520-8274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3560-8097-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3564-8219-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3568-8823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3596-8284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3644-8667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3652-8691-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3700-8214-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3752-8139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3792-8703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/3816-8119-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4036-8179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4044-8194-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4064-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4068-8528-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4140-8582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4184-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4192-8134-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4200-8384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4248-2269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4252-8739-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4260-8829-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4304-8396-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4400-8522-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4404-8104-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4424-8164-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4464-8697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4472-8576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4488-8631-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4548-2627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4548-7984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4548-1525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4548-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4664-8269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4708-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4752-8169-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4800-6090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4856-8244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4860-8259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4904-6274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4924-8372-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4956-8289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/4960-8733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5000-8625-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5024-8835-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5032-8841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5068-8793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5072-8279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5084-8474-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5164-8189-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5172-8787-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5216-8348-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5220-8305-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5260-8224-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5376-8402-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5384-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5492-8114-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5532-8492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5540-8745-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5568-8811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5576-8149-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5684-8462-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5696-8721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5728-8330-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5740-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5740-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5744-8144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5768-8468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5824-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5884-8709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5932-8159-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/5988-8209-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/6000-8450-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/6008-8853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/6032-8540-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/6048-8264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/6060-5601-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                                                    memory/6140-8432-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                                    Download