Overview

overview

7

Static

static

3

2026-09-24...op.exe

windows10-2004-x64

7

2026-09-24...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    24/09/2026, 19:02

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
  • Size 5.6MB
  • Sample260924-xpvabszale
  • SHA256 8ee9fe27dc92e54099e992aa50dc6944d869d2c94e1959125dcb30c94284bf41
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 42 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:716
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41D2.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5360
      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:1096
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45F8.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:1468
          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:1212
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a477F.bat
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:1476
              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:576
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A4E.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:4772
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:256
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D8A.bat
                      10⤵
                      • Executes a command shell one-liner
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2428
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1736
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F8D.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3776
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:4432
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51EF.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:4440
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:3780
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a552B.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:4968
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:2360
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5828.bat
                                      18⤵
                                      • System Location Discovery: System Language Discovery
                                      • Suspicious use of WriteProcessMemory
                                      PID:3416
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4604
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61AE.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:5580
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:3292
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a642F.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:3068
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:4956
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a679A.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5972
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:4800
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A97.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4476
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1944
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D85.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3896
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5096
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FE7.bat
                                                              30⤵
                                                              • System Location Discovery: System Language Discovery
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:3312
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious behavior: EnumeratesProcesses
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1604
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7380.bat
                                                                  32⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:5440
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4764
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7507.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:5764
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1932
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7797.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1192
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:5860
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:2636
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:3048
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C4A.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:2932
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:3692
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D16.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4688
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4448
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DC1.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:4972
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:4148
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E8D.bat
                                                                                              46⤵
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:1840
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:4116
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F58.bat
                                                                                                  48⤵
                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5104
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:4584
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8023.bat
                                                                                                      50⤵
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2876
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4332
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a810D.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2028
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3464
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81D8.bat
                                                                                                              54⤵
                                                                                                              • Executes a command shell one-liner
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:1740
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:2568
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8294.bat
                                                                                                                  56⤵
                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:3408
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:4324
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a835F.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:3436
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:4980
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a841A.bat
                                                                                                                          60⤵
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:4280
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:3900
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84D6.bat
                                                                                                                              62⤵
                                                                                                                                PID:4712
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                  PID:3784
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a85C0.bat
                                                                                                                                    64⤵
                                                                                                                                      PID:1592
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:2612
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a866C.bat
                                                                                                                                          66⤵
                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                          PID:5272
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            PID:1748
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8757.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:5028
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                PID:2712
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8822.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:3644
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:4292
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88FC.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        PID:472
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          PID:3352
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89C8.bat
                                                                                                                                                            74⤵
                                                                                                                                                              PID:1180
                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                75⤵
                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                PID:1148
                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A73.bat
                                                                                                                                                                  76⤵
                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:3004
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:3368
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B4E.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:1844
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:4320
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C39.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:3180
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:632
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D23.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                                PID:1420
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  83⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:2432
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8DEE.bat
                                                                                                                                                                                    84⤵
                                                                                                                                                                                      PID:1600
                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                        85⤵
                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                        PID:5648
                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E9A.bat
                                                                                                                                                                                          86⤵
                                                                                                                                                                                            PID:4192
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:5976
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F55.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                PID:5364
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:3120
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9021.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                      PID:5816
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        91⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                        PID:3924
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90DC.bat
                                                                                                                                                                                                          92⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                          PID:1332
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            PID:4756
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a91B7.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:252
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                  PID:5552
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9282.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:240
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:4644
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a936C.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                        PID:5624
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                          99⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                          PID:2144
                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9447.bat
                                                                                                                                                                                                                            100⤵
                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:728
                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                              101⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              PID:4508
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9551.bat
                                                                                                                                                                                                                                102⤵
                                                                                                                                                                                                                                  PID:5932
                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                    103⤵
                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                    PID:1072
                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a963B.bat
                                                                                                                                                                                                                                      104⤵
                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                      PID:2404
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        PID:932
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9706.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                          PID:6028
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            107⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            PID:6068
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97F1.bat
                                                                                                                                                                                                                                              108⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              PID:5064
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                109⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:5528
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a98BC.bat
                                                                                                                                                                                                                                                  110⤵
                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:4744
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9977.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                          PID:4556
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:4196
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9A52.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                PID:1048
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:3840
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B4C.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:6032
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:2316
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C07.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        PID:1656
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                          PID:5696
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CF2.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:588
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:5524
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DAD.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:3580
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                  PID:5148
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9EA7.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:1008
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      125⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      PID:4576
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F63.bat
                                                                                                                                                                                                                                                                                        126⤵
                                                                                                                                                                                                                                                                                          PID:5584
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                              PID:4496
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA00F.bat
                                                                                                                                                                                                                                                                                                128⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:6120
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                    PID:2524
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0E9.bat
                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                        PID:4304
                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                          131⤵
                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                          PID:5728
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA1C4.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                              PID:1100
                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                133⤵
                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                PID:792
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA29F.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                    PID:2376
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                        PID:5776
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA37A.bat
                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                          PID:3192
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            137⤵
                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                            PID:52
                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA454.bat
                                                                                                                                                                                                                                                                                                                              138⤵
                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                              PID:4260
                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                139⤵
                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                PID:1344
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA510.bat
                                                                                                                                                                                                                                                                                                                                  140⤵
                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                  PID:4748
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                    PID:2016
                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA5EB.bat
                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                      PID:1244
                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                        143⤵
                                                                                                                                                                                                                                                                                                                                          PID:4996
                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6B6.bat
                                                                                                                                                                                                                                                                                                                                            144⤵
                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                            PID:6124
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              145⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              PID:2696
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA7A0.bat
                                                                                                                                                                                                                                                                                                                                                146⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1716
                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                    147⤵
                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                    PID:5160
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA89A.bat
                                                                                                                                                                                                                                                                                                                                                      148⤵
                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                      PID:4372
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        149⤵
                                                                                                                                                                                                                                                                                                                                                          PID:5748
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA965.bat
                                                                                                                                                                                                                                                                                                                                                            150⤵
                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                            PID:4992
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              151⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5740
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA21.bat
                                                                                                                                                                                                                                                                                                                                                                  152⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:1964
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    153⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1700
                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAACD.bat
                                                                                                                                                                                                                                                                                                                                                                        154⤵
                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          155⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:3940
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB98.bat
                                                                                                                                                                                                                                                                                                                                                                              156⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4632
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1252
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC82.bat
                                                                                                                                                                                                                                                                                                                                                                                      158⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:3472
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        159⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:4216
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD6D.bat
                                                                                                                                                                                                                                                                                                                                                                                            160⤵
                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                            PID:4348
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              161⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:944
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE76.bat
                                                                                                                                                                                                                                                                                                                                                                                                  162⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5700
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:2164
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF41.bat
                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                          PID:4128
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB00C.bat
                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2292
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2912
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB0D8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1984
                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                    169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:884
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB1B2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB28D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB349.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5752
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2496
                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB404.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                            176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:708
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB4DF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                  178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4752
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4488
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB59A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB740.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB80B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8D6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB992.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBA4D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBAEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBB86.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBC32.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3248
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBCAF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBDF7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBE84.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBF10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBFBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC049.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC0E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC172.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC20E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC2BA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC366.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC3E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC46F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC51B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC654.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC6F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC79C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC838.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC8A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC942.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCAB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4784
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCB36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCBC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCC3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCCDB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD58.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCDE5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCE72.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCEEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCF6C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1668
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD085.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD121.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD1AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD21B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD2B7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD334.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4984
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD3B1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4904
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD42E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD4AB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2700
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD519.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD613.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD69F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD74B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD7C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD836.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8B3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5672
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD93F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD9BC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDA1A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDAA7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDB81.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDC8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          316⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5152
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              317⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDCF8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  318⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      319⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDD66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          320⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            321⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDDD3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              322⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                323⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE41.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  324⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      325⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3168
                                                                                                                                                                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                                              32⤵
                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                              PID:5916
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                33⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                                                  34⤵
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:4348
                                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                  PID:5284
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                    PID:3852
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                        PID:5568
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 984
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:4328
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 5284 -s 984
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Program crash
                                                                                                                                                                                                                                                      PID:1032
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 5284 -ip 5284
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:2732
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 5284 -ip 5284
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:2492

                                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                                          $$a41D2.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a41D2.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 bf650c6000f3461f2f744db7671dc3e64e938cb3edf55e340cba481216687313
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a45F8.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a45F8.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 afeb93be042cf1141330eb69a173b8f2b0b4b8f9b48fd81eb6439a57d803ec3a
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a477F.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a477F.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 8dfa1978a8925c5b0498c3ef6c09bff0fd0931488b8bca885da338e3d77f6c88
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a4A4E.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4A4E.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 c9b1f24a676dd50edc72c60817c8164b28032239b4fa396b3e4fb432ca5a3b75
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a4D8A.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4D8A.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 827fb6beb5117285af84e3bfc487add726137c5289b46c5ae7685dfcfcbf00f1
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a4F8D.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4F8D.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 5964becbc7bcdebce8425b9f41eead886c466d0305a802467b5b43c6be10dbd9
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a51EF.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a51EF.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 305cd88f60db0a94459fb77f1d9a98dc03810115e60f1ff1986103dfd7e805ba
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a552B.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a552B.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 45ee9afa6b416dc7a419d2e97a7719b3912b57fbd8312061a5d7ae8a65b584fe
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a5828.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a5828.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 2b787dc6f27652e0a81511e4e1ac22738eb11763717f43043bca83ad20273b22
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a61AE.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a61AE.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 83679b04437bf0addca291c7457fbb3f414423d7309793a88cdd63ea64e4be95
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a642F.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a642F.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 aeda01e5e39e03f50601b0e1b0ff5bd37e1cf35bb9cfce8f98d8b9a602e8f48b
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a679A.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a679A.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 98434bad75e0954f19ae4aa1ff2b003985bdad9dfc957ff13755638e07450d49
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a6A97.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6A97.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 bac3095ad0abba98e8170bbb5ab0279a02931e686a7a5e342463372ab1a334a2
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a6D85.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6D85.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 dc0c63d3dd1f539d5feed6272265fe38561af8d4dc2e5465d243dbb88a37e3aa
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a6FE7.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a6FE7.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 d3f26378c57b1708672405abf25cea73fa3013cbe18fd7bb15d99c876fc9a330
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a7380.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7380.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 214f18fda1d90a0753c2ab86d200e7019870a501ad70701c52030e49bbe3be71
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a7507.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7507.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 ba0c3c0205220141682165dad4ef0ce0981aa0c53b25eea16ce02b294f1b295a
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a7797.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7797.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 74ef957a8b26063c22881ed9bb027937ed86f1d9f8ac702f48d74cf682111ad2
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          $$a7A18.bat
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a7A18.bat
                                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                                          • SHA256 2b82fce03052e4f742b3800c7de0c09a321cf3a49d1cf8a38de054e933860241
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                          • SHA256 5606a775e0df92bfb51a711624d3992315b7697be924ade23e27cf2ba749d3c1
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.6MB
                                                                                                                                                                                                                                                          • SHA256 8917025a228fa4894efe8bab44d00e842d751202e5d204524ce13c98599d3dac
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                          • SHA256 7ecded1f737ed142448f38943a4045b62e7dba11e0afb99c83011e9217850ee2
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.5MB
                                                                                                                                                                                                                                                          • SHA256 37d48695e190d2eead5b296f5fa5411ad994ef1324146c521126b85b8a363669
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                          • SHA256 38e959ac9c8931d06e7ed2670d77360df2f7fea954a3b1c47bac3539fea6e734
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                          • SHA256 ed15779d8075cceebaa51c2395fbbf5b05c46ede74c46af6f5d0e6db95ccdb90
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.2MB
                                                                                                                                                                                                                                                          • SHA256 a5e6545988aa862448f90eab60528d9f9dcdd122a174003d47e7eba99fa8c115
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                                          • SHA256 efdba0e7c4145e90a2a932f5aa7c90ee181e2d19159b809909f5a6eacc5cc462
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                                          • SHA256 66fe5723c174865f441f63fcbc7e5679136b8a4e21163423cd348208c6a800d0
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.2MB
                                                                                                                                                                                                                                                          • SHA256 807b8aee07e5847dfb92c4286b8ec0e8cc90578c0689af15fe9eebefbc1788e5
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                                          • SHA256 1be81cbdfedb982fddd064291c11e0b1d995198bafb64207190d49e6868b047b
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                                          • SHA256 2dfb7c453e4c34c79b7b08f1623de9d681191009a690db4a0ccfaf189b75d69f
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                                          • SHA256 351d6f41af2bd063528d56f960032bfe53303e80d20faffe3e335578c30d0c3a
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                                          • SHA256 ed3edeea072159877fbb558e67cc7e5ef7c291ea7008209716d9457195f3979a
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.2MB
                                                                                                                                                                                                                                                          • SHA256 5697a6d1b79607e06871dd23a7ac7afd9c2631a1f1876dd5ae5caf365cb05592
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                                          • SHA256 347a1f78aa957cde79ccd97510074e3603cf303bce054eb996a5403d9e3e7e0e
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                                          • SHA256 68f44dd8d79b84c1f232228f59af98d7fb6087b09f0b7e7e38c6125407e7e957
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-24_e7ab2b98537683fcfd6d189cc3d8863a_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                                          • SHA256 8f608111c69edb7781a0be420c6b593282ef42fcf29c228562772299dd31234e
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          Logo1_.exe
                                                                                                                                                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          _desktop.ini
                                                                                                                                                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-2304238888-3968896904-642854331-1000\_desktop.ini
                                                                                                                                                                                                                                                          • Size 9B
                                                                                                                                                                                                                                                          • SHA256 346de4d5debec31c9a445d77ea11610cbefd2c8caf903962fbf17b7ec8847d33
                                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                                          memory/52-2466-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/256-56-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/268-2965-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/484-2658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/564-2929-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/576-42-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/632-2319-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/716-15-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/716-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/792-2454-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/828-2959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/884-2562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/932-2379-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/944-2538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1032-2713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1072-2374-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1096-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1104-2604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1128-2586-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1132-2923-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1148-2304-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1184-2694-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1204-2628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1208-2761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1212-33-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1252-2526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1260-2634-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1320-2821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1344-2472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1548-2676-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1604-2179-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1668-2851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1700-2514-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1736-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1748-2284-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1932-2195-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/1944-2152-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2016-2478-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2080-2857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2144-2364-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2164-2544-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2316-2410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2360-94-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2400-2749-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2408-2863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2432-2324-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2496-2580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2508-2809-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2524-2442-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2540-2845-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2568-2254-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2572-2574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2612-2279-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2656-2791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2696-2490-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2712-2289-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2740-2881-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2764-2947-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2820-2899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2912-2556-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/2964-2688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3048-2213-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3120-2339-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3176-2905-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3196-2779-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3200-2743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3236-2911-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3292-2208-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3292-1865-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3352-2299-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3356-2701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3368-2309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3464-2249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3492-2755-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3548-2670-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3692-2218-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3704-2893-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3724-2640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3780-86-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3784-2274-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3788-2773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3832-2827-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3840-2405-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3872-2935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3900-2269-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3908-2803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3924-2344-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3940-2520-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3952-2833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/3968-2887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4116-2233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4128-2550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4148-2228-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4152-2917-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4196-2399-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4216-2532-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4268-2953-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4292-2294-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4320-2314-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4324-2259-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4328-2707-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4332-2244-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4340-2598-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4380-2622-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4396-2731-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4400-2616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4412-2785-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4432-76-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4448-2223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4488-2592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4496-2436-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4508-2369-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4512-2646-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4576-2430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4584-2238-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4604-1857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4616-2737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4644-2359-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4700-2664-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4720-2652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4744-2394-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4756-2349-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4764-2187-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4780-2568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4800-2144-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4844-2941-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4848-2839-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4944-2869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4952-2719-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4956-2135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4980-2264-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/4996-2484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5096-2160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5148-2425-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5160-2496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5268-2725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5284-1423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5284-2162-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5284-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5284-2139-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5456-2610-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5480-2682-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5524-2420-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5528-2389-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5552-2354-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5604-2797-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5648-2329-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5676-2767-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5696-2415-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5728-2448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5740-2508-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5748-2502-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5776-2460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5860-2205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5900-2875-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5916-2174-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5916-2239-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5924-2815-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/5976-2334-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                                          memory/6068-2384-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                                          Download