Overview

overview

7

Static

static

3

2026-09-30...op.exe

windows10-2004-x64

7

2026-09-30...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 07:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
  • Size 4.8MB
  • Sample260930-h7bhlsvthx
  • SHA256 51c6f3033fd4254226c81bcc39ac1694e5849e1fce9367eb37ef77d900ba020e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC7DF.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:1832
      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4808
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCA21.bat
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3820
          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:2808
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCD7C.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:1620
              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:3544
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD201.bat
                  8⤵
                  • Executes a command shell one-liner
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:3884
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:1020
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD339.bat
                      10⤵
                      • Suspicious use of WriteProcessMemory
                      PID:4800
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:1964
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD5AA.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:2684
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:1880
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD8A8.bat
                              14⤵
                              • Suspicious use of WriteProcessMemory
                              PID:4640
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:4424
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDBD4.bat
                                  16⤵
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious use of WriteProcessMemory
                                  PID:3140
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:5028
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDE07.bat
                                      18⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:1784
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • System Location Discovery: System Language Discovery
                                        • Suspicious use of WriteProcessMemory
                                        PID:1628
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE2AA.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2628
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:740
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE7CB.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:1564
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:3208
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEA8A.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • System Location Discovery: System Language Discovery
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:4172
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:1092
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEE33.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4008
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:3020
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF131.bat
                                                          28⤵
                                                          • Executes a command shell one-liner
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:3076
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:4004
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF400.bat
                                                              30⤵
                                                              • Executes a command shell one-liner
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4796
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:1272
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF95F.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2640
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • System Location Discovery: System Language Discovery
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:984
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFEED.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4688
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:1384
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a219.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:1312
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Drops file in Windows directory
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:2380
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a536.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:1476
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:6112
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D0.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:3928
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2400
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8F.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:3252
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:5496
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF67.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5528
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • System Location Discovery: System Language Discovery
                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:5700
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1090.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:5736
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:5880
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a11D8.bat
                                                                                                  48⤵
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5908
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Drops file in Windows directory
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5956
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a12F2.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:5996
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:6052
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a139E.bat
                                                                                                          52⤵
                                                                                                          • Executes a command shell one-liner
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:6080
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:3488
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a142A.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:4648
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Drops file in Windows directory
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:3344
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a14A7.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1884
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:1452
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1553.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:2600
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        PID:2756
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15E0.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                          PID:2592
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            PID:1048
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a165D.bat
                                                                                                                              62⤵
                                                                                                                                PID:4140
                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                  63⤵
                                                                                                                                  • Executes dropped EXE
                                                                                                                                  PID:1612
                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1709.bat
                                                                                                                                    64⤵
                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                    PID:4000
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      PID:5172
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a17A5.bat
                                                                                                                                        66⤵
                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                        PID:5176
                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                          67⤵
                                                                                                                                          • Executes dropped EXE
                                                                                                                                          • Drops file in Windows directory
                                                                                                                                          PID:2796
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1851.bat
                                                                                                                                            68⤵
                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                            PID:2556
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              69⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              • Drops file in Windows directory
                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                              PID:4196
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a18CE.bat
                                                                                                                                                70⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:4192
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  71⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:4732
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a195A.bat
                                                                                                                                                    72⤵
                                                                                                                                                      PID:3852
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        73⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:1892
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a19F7.bat
                                                                                                                                                          74⤵
                                                                                                                                                            PID:4284
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                              PID:1356
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AA2.bat
                                                                                                                                                                76⤵
                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                PID:5136
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  77⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                  PID:5060
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B5E.bat
                                                                                                                                                                    78⤵
                                                                                                                                                                      PID:5196
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        PID:5252
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BDB.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:5284
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            81⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                            PID:5332
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1C87.bat
                                                                                                                                                                              82⤵
                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                              PID:5344
                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                83⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                PID:5424
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D23.bat
                                                                                                                                                                                  84⤵
                                                                                                                                                                                    PID:5452
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      85⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                      PID:5404
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DEE.bat
                                                                                                                                                                                        86⤵
                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                        PID:5504
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          87⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:5624
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EB9.bat
                                                                                                                                                                                            88⤵
                                                                                                                                                                                              PID:1536
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                89⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                PID:5668
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F46.bat
                                                                                                                                                                                                  90⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3460
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    91⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    PID:4700
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a212A.bat
                                                                                                                                                                                                      92⤵
                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                      PID:5544
                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                        93⤵
                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                        PID:5804
                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a21E6.bat
                                                                                                                                                                                                          94⤵
                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                          PID:5896
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            95⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            PID:5980
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a22B1.bat
                                                                                                                                                                                                              96⤵
                                                                                                                                                                                                                PID:6036
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  97⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:3676
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a235D.bat
                                                                                                                                                                                                                    98⤵
                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                    PID:6060
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      99⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      PID:4612
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23E9.bat
                                                                                                                                                                                                                        100⤵
                                                                                                                                                                                                                          PID:6084
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            101⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                            PID:4500
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a261C.bat
                                                                                                                                                                                                                              102⤵
                                                                                                                                                                                                                                PID:1344
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  103⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                  PID:3596
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a26D7.bat
                                                                                                                                                                                                                                    104⤵
                                                                                                                                                                                                                                      PID:3868
                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                        105⤵
                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                        PID:3956
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27B2.bat
                                                                                                                                                                                                                                          106⤵
                                                                                                                                                                                                                                            PID:4984
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:3716
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C56.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:4280
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                  PID:4608
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2CE2.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                      PID:1780
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                        PID:4076
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D6F.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                            PID:404
                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                              113⤵
                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                              PID:2484
                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2E79.bat
                                                                                                                                                                                                                                                                114⤵
                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                PID:3924
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:808
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F82.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                    PID:1700
                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                      117⤵
                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                      PID:5144
                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2FFF.bat
                                                                                                                                                                                                                                                                        118⤵
                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        PID:5272
                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                          119⤵
                                                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                                                          PID:5232
                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3118.bat
                                                                                                                                                                                                                                                                            120⤵
                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                            PID:5392
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              121⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                              PID:5304
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3176.bat
                                                                                                                                                                                                                                                                                122⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:5428
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  123⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:5356
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3222.bat
                                                                                                                                                                                                                                                                                    124⤵
                                                                                                                                                                                                                                                                                      PID:5516
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        125⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        PID:5640
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32CE.bat
                                                                                                                                                                                                                                                                                          126⤵
                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                          PID:5588
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            127⤵
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:4108
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a335B.bat
                                                                                                                                                                                                                                                                                              128⤵
                                                                                                                                                                                                                                                                                                PID:5576
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  129⤵
                                                                                                                                                                                                                                                                                                    PID:5716
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3426.bat
                                                                                                                                                                                                                                                                                                      130⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                      PID:5696
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        131⤵
                                                                                                                                                                                                                                                                                                          PID:3784
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34F1.bat
                                                                                                                                                                                                                                                                                                            132⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:1672
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              133⤵
                                                                                                                                                                                                                                                                                                                PID:5828
                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a357D.bat
                                                                                                                                                                                                                                                                                                                  134⤵
                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                  PID:5960
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    135⤵
                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                    PID:5820
                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3639.bat
                                                                                                                                                                                                                                                                                                                      136⤵
                                                                                                                                                                                                                                                                                                                        PID:6064
                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                          137⤵
                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36C6.bat
                                                                                                                                                                                                                                                                                                                            138⤵
                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                            PID:6048
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                              139⤵
                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a37FE.bat
                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                  PID:2576
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    141⤵
                                                                                                                                                                                                                                                                                                                                      PID:4664
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38E8.bat
                                                                                                                                                                                                                                                                                                                                        142⤵
                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                        PID:1556
                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                            PID:2212
                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39A4.bat
                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                PID:700
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                  PID:4988
                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3ACD.bat
                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1816
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3780
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B3A.bat
                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                              PID:916
                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                149⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:4452
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BC7.bat
                                                                                                                                                                                                                                                                                                                                                                    150⤵
                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                    PID:3068
                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                      151⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5128
                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3CA2.bat
                                                                                                                                                                                                                                                                                                                                                                          152⤵
                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                          PID:5156
                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                            153⤵
                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                            PID:5244
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D2E.bat
                                                                                                                                                                                                                                                                                                                                                                              154⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:5444
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  155⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:5308
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3DBB.bat
                                                                                                                                                                                                                                                                                                                                                                                    156⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:5312
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        157⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:5416
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E47.bat
                                                                                                                                                                                                                                                                                                                                                                                          158⤵
                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                            159⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:5476
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F32.bat
                                                                                                                                                                                                                                                                                                                                                                                                160⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:3212
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  161⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FCE.bat
                                                                                                                                                                                                                                                                                                                                                                                                    162⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5724
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      163⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1588
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a408A.bat
                                                                                                                                                                                                                                                                                                                                                                                                        164⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:2192
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            165⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:5864
                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4145.bat
                                                                                                                                                                                                                                                                                                                                                                                                                166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                PID:5884
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5840
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a41F1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5932
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4216
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4404.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5080
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                    173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a44CF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                      174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4368
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a456C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4204
                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5000
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4627.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4576
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                            180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a479E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a484A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a48E6.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a49A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BA5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4C70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D1C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DF7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EC2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a501A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2172
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51A1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4704
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a524C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4788
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5395.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a546F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a555A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5615.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56A2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a577D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5628
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5809.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58A5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:6056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5932.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5900
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5072
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A3C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3472
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AB9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B36.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C3F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3796
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5CFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2644
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D97.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5EA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2568
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6018.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60D3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6131.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:864
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61BE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a624A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62D7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5944
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6392.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a642F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:888
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64EA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6577.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6642.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a66BF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2168
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a67A9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3740
                                                                                                                                                                                                                                                                • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                  C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                  46⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Enumerates connected drives
                                                                                                                                                                                                                                                                  • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                  PID:5744
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                    net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                    47⤵
                                                                                                                                                                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                    PID:5780
                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                      48⤵
                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                      PID:5852
                                                                                                                                                                        • C:\Windows\Logo1_.exe
                                                                                                                                                                          C:\Windows\Logo1_.exe
                                                                                                                                                                          2⤵
                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                          • Drops file in Program Files directory
                                                                                                                                                                          • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                                                                          PID:1532
                                                                                                                                                                          • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                            net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                            3⤵
                                                                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                                                                            PID:4860
                                                                                                                                                                            • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                              C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:2912
                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 996
                                                                                                                                                                              3⤵
                                                                                                                                                                              • Program crash
                                                                                                                                                                              PID:3212
                                                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1532 -ip 1532
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:620

                                                                                                                                                                          Network

                                                                                                                                                                                MITRE ATT&CK Enterprise v16

                                                                                                                                                                                Replay Monitor

                                                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                                                Downloads

                                                                                                                                                                                $$a219.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a219.bat
                                                                                                                                                                                • Size 775B
                                                                                                                                                                                • SHA256 f19580a5e17a801ab19714df4f3e3593f9b19023e6554203495ad59002e67eba
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$a536.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a536.bat
                                                                                                                                                                                • Size 775B
                                                                                                                                                                                • SHA256 006c7daaebe08953e69633731577bf30e7985001a611d8560fc91951475316ee
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$a8D0.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$a8D0.bat
                                                                                                                                                                                • Size 775B
                                                                                                                                                                                • SHA256 13e36eb05ecd61caef40aad263c3dbaba7473fab56bfd0851e530ecfead63ec2
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aB8F.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aB8F.bat
                                                                                                                                                                                • Size 775B
                                                                                                                                                                                • SHA256 1e699f4f31a68406d62e4c000c00a4af4f615ddf8e494cc47adab3c3a969b1f6
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aC7DF.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aC7DF.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 dd707a3f5f3c42bdd1643c23b3dac619e59b26cb39e39b8ef460b74e08e393b6
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aCA21.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCA21.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 ad1692f1dc7bc559b1bbeecc6f72e1e661fa002d8b4a8b377897dedad0f05377
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aCD7C.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aCD7C.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 291b5016bbaac92f20fdd64be3add0f41df6e85866c5442ca360784e30c7d283
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aD201.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD201.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 c0a765ea73f2ef95d754f58c9c6baaa129c0d90160b36eba00feb86c493c5651
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aD339.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD339.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 3a874bfabd52b239b6b2ed491757ae6a7dfaff093922e3fe150bd040c1e2a900
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aD5AA.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD5AA.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 f7e63abe2e0e5d1115c724e650eeba73056e6856de8fb2e0f326e5a919a36afd
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aD8A8.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aD8A8.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 62b67575426ee4ea05d1697480ba27862cbadea40ad7be9b2e9a99eaaad70ee2
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aDBD4.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aDBD4.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 8e0a16bff17a3f59e5d004bee54d556fd9747d2c6ca9b7eb34641064f5c0e160
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aDE07.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aDE07.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 8e8a3293426895f50dc08927222c9746efaedfca687c09ad5c0695b34d49032d
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aE2AA.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE2AA.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 c997cce5759bd61b173e41d8a86893cfd71c08eb00c9adf9d65a83a4afaf9584
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aE7CB.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aE7CB.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 b0ccac3024c57a2ad95b6e681a955b12b275a43f986aed6575ef96728b0b434e
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aEA8A.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aEA8A.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 a5c2d8504f3c3299205b0ef7b033cf03e6e803ec459a380c67da3671e79e44b7
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aEE33.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aEE33.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 8b48b8367e2ed7d072d8d2be82cb14c9765d74cd475fb2a5851b3919ab403722
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aF131.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF131.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 e0780d7d617941995e421b92f17bcb69f3a04c4ab8ec0aeb735095753b6cbf0d
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aF400.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF400.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 c05ede9a06a1fb07e8acee97bcea9355e6fff472e1b905cbf3f9234007436f0f
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aF95F.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aF95F.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 2e089f5c1ea737b6e65fa3ac731dcbea07e35ee741c05c6e9765c330be920241
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                $$aFEED.bat
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\$$aFEED.bat
                                                                                                                                                                                • Size 776B
                                                                                                                                                                                • SHA256 0b7006ead4439e907bedad7d2e44de550c5069f130d2371d7fdfaf93f96fe5ba
                                                                                                                                                                                • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.8MB
                                                                                                                                                                                • SHA256 1ab46f92f4a58b0b7e52905a9e08d24e97ec69f80f87324e92f6636f243abf8c
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.5MB
                                                                                                                                                                                • SHA256 2fbe249945e121d236219e212aeca90bf2837075446a4294fb543995f1ef68de
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.4MB
                                                                                                                                                                                • SHA256 2ffa7c404d1e3a35ec08dd4b29b52d42b0cb11f6d6f5b1fd218e08bcd7294dd6
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.4MB
                                                                                                                                                                                • SHA256 fbdf4ebf825add0e8521427b96faee7ca1444784ce79f0bcd6e9b5206129ca69
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.4MB
                                                                                                                                                                                • SHA256 706fcb727982fe8eb757e1b5460de4aec1c81ffaa60760669f264f527dc4fd4b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.3MB
                                                                                                                                                                                • SHA256 21b7acd525572321d7be96b71dcf2b3b50bbc598f160626806ab2635db2f4c8b
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.3MB
                                                                                                                                                                                • SHA256 6bb01143555c49acce197029d4f2414ba3bef93c60bbaf455664d2a7217d6265
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.3MB
                                                                                                                                                                                • SHA256 89884f372b7b41fc22f4a9d0fbba37990d8f5b0e91074dd2966e93d85bb64362
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                                • SHA256 668f697ca3e26b6a32f56d3b04fe3371f0a105914145e2d28bba55a395bece6c
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                                • SHA256 408dcb4c88230ca82ffcb131948282b5f0434019703fcad6df0a6372426aeddc
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                                • SHA256 0a0691f24216b4cd6086ab6a5c61de9337b20ff41ca4d1811914c31a6abe726e
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                                • SHA256 e9634e16e0807a533d3e7cedabf3533cc30022f677a917edca6d3654158078e1
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                                • SHA256 621ccfa72b196916a650296ec23664386b8b359789ea9e2468ee701071b0c0d5
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.7MB
                                                                                                                                                                                • SHA256 ad205e764a2d7422e1113b46f3415904854b128d5f655349da830968d942bd24
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.2MB
                                                                                                                                                                                • SHA256 3e20e7a277ee9254f28343cb5ab63d6f04028b0147a2519aa70eff33a48be81d
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                                • SHA256 b6484dc3f03a1f4253ea82e1bfd764e211170e7b1f14c5de4d2ce2debf41fe5f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                                • SHA256 c453c441084947184a6aecc2ab10aa2e92c6807685b75d8c050bbe6a104ea8c4
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.6MB
                                                                                                                                                                                • SHA256 88e3803dd0b373baf72c726f33230fc1795f5b1fae9026940676c52adb2655fd
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.5MB
                                                                                                                                                                                • SHA256 dc1bc28f1dc41e52807d5aa2b3caf67add124a8cf9d7be38c818554d144a3ef7
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_db867f39fbbb2bd69933fba94036b24e_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                • Size 4.5MB
                                                                                                                                                                                • SHA256 208bfd09b7b02049f7b370a5e772de813fbaebbfb817175240eaee3bb664886f
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                Logo1_.exe
                                                                                                                                                                                • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                • Size 32KB
                                                                                                                                                                                • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                Submit Download

                                                                                                                                                                                _desktop.ini
                                                                                                                                                                                • Path F:\$RECYCLE.BIN\S-1-5-21-2101206053-1414382737-268919432-1000\_desktop.ini
                                                                                                                                                                                • Size 9B
                                                                                                                                                                                • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                • MD5 SHA1 SHA512
                                                                                                                                                                                Submit Download

                                                                                                                                                                                memory/384-5934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/436-5868-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/560-5823-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/740-1667-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/808-5550-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/812-5818-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/864-5894-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/888-5919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/984-4016-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1020-50-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1048-5438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1092-1869-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1156-5940-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1156-5935-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1204-5843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1264-5793-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1272-2621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1352-5693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1356-5468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1384-4385-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1452-5430-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1532-704-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1532-2247-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1532-9-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1532-5398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1588-5663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1612-5443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1628-708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1836-5708-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1880-68-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1892-5464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/1964-57-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2172-5773-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2176-5853-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2208-5603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2212-5613-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2380-4568-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2400-5205-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2484-5546-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2756-5434-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2796-5452-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2808-29-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2916-5914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/2948-5713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3020-2251-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3208-1862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3344-5426-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3488-5422-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3544-43-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3552-5863-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3596-5525-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3676-5513-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3684-5848-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3716-5533-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3780-5623-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3784-5582-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3796-5858-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3916-5813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3956-5529-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/3968-5783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4004-2488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4052-5924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4056-5929-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4076-5542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4108-5574-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4196-5456-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4216-5683-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4304-5688-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4332-5597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4424-77-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4444-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4444-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4452-5628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4500-5521-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4568-5763-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4608-5538-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4612-5517-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4664-5608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4700-5500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4704-5778-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4732-5460-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4756-5703-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4788-5788-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4808-20-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4932-5743-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4940-5768-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4948-5874-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/4988-5618-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5000-5698-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5028-84-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5060-5472-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5072-5838-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5128-5633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5144-5554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5172-5448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5232-5558-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5244-5638-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5252-5476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5292-5723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5300-5718-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5304-5562-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5308-5643-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5328-5879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5332-5480-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5348-5733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5356-5566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5360-5803-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5364-5798-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5404-5488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5416-5648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5424-5484-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5460-5889-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5476-5653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5484-5884-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5496-5370-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5500-5728-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5560-5738-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5596-5658-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5604-5808-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5624-5492-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5640-5570-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5664-5899-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5668-5496-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5700-5406-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5716-5578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5744-5444-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5804-5504-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5820-5592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5828-5587-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5840-5673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5848-5904-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5864-5668-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5880-5410-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5892-5748-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5932-5678-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5936-5758-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5944-5909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5956-5414-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/5980-5509-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/6052-5418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/6056-5828-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/6112-5066-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/6124-5833-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download

                                                                                                                                                                                memory/6140-5753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                Download