Overview

overview

7

Static

static

3

2026-09-30...op.exe

windows10-2004-x64

7

2026-09-30...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 12:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
  • Size 5.4MB
  • Sample260930-p5aa4azbnd
  • SHA256 98192071f126f594b39ab291036a97ac0236fbceae687694dbd000c5a58e0163
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecution

Malware Config

Signatures

  • Executes dropped EXE 64 IoCs
  • Enumerates connected drives 3 TTPs 44 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Program crash 1 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2268
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB62C.bat
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4124
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB958.bat
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4496
          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:3308
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aBD9E.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4664
              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Drops file in Windows directory
                • Suspicious use of WriteProcessMemory
                PID:4324
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC203.bat
                  8⤵
                  • Suspicious use of WriteProcessMemory
                  PID:560
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:1748
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC5AC.bat
                      10⤵
                      • Executes a command shell one-liner
                      • Suspicious use of WriteProcessMemory
                      PID:316
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Suspicious use of WriteProcessMemory
                        PID:4444
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aC9B4.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:3460
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Drops file in Windows directory
                            • Suspicious use of WriteProcessMemory
                            PID:3424
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aCFBF.bat
                              14⤵
                              • Executes a command shell one-liner
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:228
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • Suspicious use of WriteProcessMemory
                                PID:4480
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD695.bat
                                  16⤵
                                  • Executes a command shell one-liner
                                  • Suspicious use of WriteProcessMemory
                                  PID:752
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Drops file in Windows directory
                                    • Suspicious use of WriteProcessMemory
                                    PID:260
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aDF8D.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:2172
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Suspicious use of WriteProcessMemory
                                        PID:2904
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE1C0.bat
                                          20⤵
                                          • Executes a command shell one-liner
                                          • Suspicious use of WriteProcessMemory
                                          PID:4412
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:1044
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE951.bat
                                              22⤵
                                              • System Location Discovery: System Language Discovery
                                              • Suspicious use of WriteProcessMemory
                                              PID:5152
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • System Location Discovery: System Language Discovery
                                                • Suspicious use of WriteProcessMemory
                                                PID:5748
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEEB0.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5772
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:732
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF289.bat
                                                      26⤵
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:4924
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:4932
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF5E4.bat
                                                          28⤵
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1880
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:5684
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFBC0.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4432
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:4888
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFE70.bat
                                                                  32⤵
                                                                  • System Location Discovery: System Language Discovery
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:3828
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Drops file in Windows directory
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:5156
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A6.bat
                                                                      34⤵
                                                                      • Executes a command shell one-liner
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:2040
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:4100
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65F.bat
                                                                          36⤵
                                                                          • Executes a command shell one-liner
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:4296
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:3248
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CA.bat
                                                                              38⤵
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4748
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Drops file in Windows directory
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1176
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aD35.bat
                                                                                  40⤵
                                                                                  • Executes a command shell one-liner
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:1620
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:4400
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE10.bat
                                                                                      42⤵
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4240
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:3720
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEFA.bat
                                                                                          44⤵
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5096
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Drops file in Windows directory
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:3928
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aFD5.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4328
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Drops file in Windows directory
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2624
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a10B0.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:3996
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5164
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a116B.bat
                                                                                                      50⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:4316
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4372
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1255.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:5212
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5256
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a141B.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:5292
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:5400
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1515.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:5516
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:5412
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a15D0.bat
                                                                                                                      58⤵
                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:5396
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                        PID:5480
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a168C.bat
                                                                                                                          60⤵
                                                                                                                            PID:5512
                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                              61⤵
                                                                                                                              • Executes dropped EXE
                                                                                                                              • Drops file in Windows directory
                                                                                                                              PID:5644
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1795.bat
                                                                                                                                62⤵
                                                                                                                                  PID:5608
                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                    63⤵
                                                                                                                                    • Executes dropped EXE
                                                                                                                                    PID:2160
                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a188F.bat
                                                                                                                                      64⤵
                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                      PID:1236
                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                        65⤵
                                                                                                                                        • Executes dropped EXE
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        PID:4640
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a194B.bat
                                                                                                                                          66⤵
                                                                                                                                            PID:1900
                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                              67⤵
                                                                                                                                              • Executes dropped EXE
                                                                                                                                              PID:5780
                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1AD1.bat
                                                                                                                                                68⤵
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:5832
                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                  69⤵
                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                  PID:5944
                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1BBC.bat
                                                                                                                                                    70⤵
                                                                                                                                                      PID:5916
                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                        71⤵
                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                        PID:5980
                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1D23.bat
                                                                                                                                                          72⤵
                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                          PID:5808
                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                            73⤵
                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                            PID:6124
                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1DFE.bat
                                                                                                                                                              74⤵
                                                                                                                                                                PID:6100
                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                  75⤵
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                  PID:3972
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1EB9.bat
                                                                                                                                                                    76⤵
                                                                                                                                                                      PID:2356
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        77⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                        PID:5700
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F75.bat
                                                                                                                                                                          78⤵
                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                          PID:1424
                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                            79⤵
                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                            PID:1200
                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2050.bat
                                                                                                                                                                              80⤵
                                                                                                                                                                                PID:2360
                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                  81⤵
                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                  PID:3932
                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a212A.bat
                                                                                                                                                                                    82⤵
                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                    PID:2516
                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                      83⤵
                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                      PID:4428
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2224.bat
                                                                                                                                                                                        84⤵
                                                                                                                                                                                          PID:4872
                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                            85⤵
                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                            PID:4944
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a23DA.bat
                                                                                                                                                                                              86⤵
                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                              PID:728
                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                87⤵
                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                PID:3960
                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2570.bat
                                                                                                                                                                                                  88⤵
                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                  PID:3848
                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                    89⤵
                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                    PID:3768
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a267A.bat
                                                                                                                                                                                                      90⤵
                                                                                                                                                                                                        PID:4056
                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                          91⤵
                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                          PID:2956
                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a27C2.bat
                                                                                                                                                                                                            92⤵
                                                                                                                                                                                                              PID:2084
                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                93⤵
                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                PID:2528
                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a287D.bat
                                                                                                                                                                                                                  94⤵
                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                  PID:1368
                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                    95⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                    PID:5208
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2A62.bat
                                                                                                                                                                                                                      96⤵
                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                      PID:2580
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                        97⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:5264
                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2B5C.bat
                                                                                                                                                                                                                          98⤵
                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                          PID:1128
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            PID:5368
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C08.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                                PID:5332
                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                  101⤵
                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                  PID:5588
                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2D30.bat
                                                                                                                                                                                                                                    102⤵
                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                    PID:5504
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:5456
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2DEC.bat
                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                          PID:5656
                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                            105⤵
                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                            PID:5564
                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2EC7.bat
                                                                                                                                                                                                                                              106⤵
                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                              PID:1220
                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                107⤵
                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                PID:3076
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2F63.bat
                                                                                                                                                                                                                                                  108⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:5196
                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                    109⤵
                                                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                                                    PID:5836
                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a302E.bat
                                                                                                                                                                                                                                                      110⤵
                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                      PID:5796
                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                        111⤵
                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                        PID:5752
                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3118.bat
                                                                                                                                                                                                                                                          112⤵
                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                          PID:5788
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            PID:5956
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a31F3.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                PID:5784
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  PID:6056
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a32AF.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                      PID:3312
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                        PID:5680
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a336A.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                            PID:4248
                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                              119⤵
                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                              PID:868
                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3416.bat
                                                                                                                                                                                                                                                                                120⤵
                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                PID:1036
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:1276
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a34C2.bat
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                      PID:3028
                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                        123⤵
                                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a35FA.bat
                                                                                                                                                                                                                                                                                          124⤵
                                                                                                                                                                                                                                                                                            PID:4816
                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                              125⤵
                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                              PID:3612
                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3668.bat
                                                                                                                                                                                                                                                                                                126⤵
                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                PID:3132
                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                  127⤵
                                                                                                                                                                                                                                                                                                    PID:2392
                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a36E5.bat
                                                                                                                                                                                                                                                                                                      128⤵
                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                      PID:640
                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                        129⤵
                                                                                                                                                                                                                                                                                                          PID:1464
                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3771.bat
                                                                                                                                                                                                                                                                                                            130⤵
                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                            PID:4528
                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                              131⤵
                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                              PID:4716
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a389A.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                PID:396
                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                  133⤵
                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                  PID:3484
                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a39A4.bat
                                                                                                                                                                                                                                                                                                                    134⤵
                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                    PID:4504
                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                      135⤵
                                                                                                                                                                                                                                                                                                                        PID:5224
                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3B3A.bat
                                                                                                                                                                                                                                                                                                                          136⤵
                                                                                                                                                                                                                                                                                                                            PID:5296
                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                              137⤵
                                                                                                                                                                                                                                                                                                                                PID:5320
                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3BF6.bat
                                                                                                                                                                                                                                                                                                                                  138⤵
                                                                                                                                                                                                                                                                                                                                    PID:5360
                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                      139⤵
                                                                                                                                                                                                                                                                                                                                        PID:5328
                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D0F.bat
                                                                                                                                                                                                                                                                                                                                          140⤵
                                                                                                                                                                                                                                                                                                                                            PID:5308
                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                              141⤵
                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                              PID:5536
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3E19.bat
                                                                                                                                                                                                                                                                                                                                                142⤵
                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                PID:5556
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  143⤵
                                                                                                                                                                                                                                                                                                                                                    PID:2684
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3F22.bat
                                                                                                                                                                                                                                                                                                                                                      144⤵
                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                      PID:4320
                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                        145⤵
                                                                                                                                                                                                                                                                                                                                                          PID:3888
                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FCE.bat
                                                                                                                                                                                                                                                                                                                                                            146⤵
                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                            PID:5736
                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                              147⤵
                                                                                                                                                                                                                                                                                                                                                                PID:5800
                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a40D8.bat
                                                                                                                                                                                                                                                                                                                                                                  148⤵
                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                  PID:5572
                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                    149⤵
                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                    PID:5960
                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4174.bat
                                                                                                                                                                                                                                                                                                                                                                      150⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:5992
                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                          151⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:2388
                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4201.bat
                                                                                                                                                                                                                                                                                                                                                                              152⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:4712
                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                  153⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                  PID:1728
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a42CC.bat
                                                                                                                                                                                                                                                                                                                                                                                    154⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1584
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        155⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                        PID:1716
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4378.bat
                                                                                                                                                                                                                                                                                                                                                                                          156⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:3940
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              157⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:5136
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4481.bat
                                                                                                                                                                                                                                                                                                                                                                                                  158⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4780
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a453D.bat
                                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                        PID:3976
                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                          161⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2348
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a45F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:3068
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3368
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a46A4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4552
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                          165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3604
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4750.bat
                                                                                                                                                                                                                                                                                                                                                                                                                            166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4820
                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                              167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3904
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a47CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                  168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5316
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5464
                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4869.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                        170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5364
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                          171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4982.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                              172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5428
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3224
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A4E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                    174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4792
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                        175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5440
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ADA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                          176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5492
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5804
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5876
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CBF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4D5B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3744
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4E07.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4ED2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4F5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2852
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3552
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FFB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2748
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5181.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2980
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a52C9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5148
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a53E3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3728
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a54AE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5589.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5663.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a572E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a57CB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a58B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5580
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a59AF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3660
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5AA9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B93.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4592
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C8D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5872
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D49.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5924
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E14.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1068
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E91.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:680
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F1E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6008.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6141.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2080
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6529.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2760
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2772
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a65E4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6690.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a675B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6836.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:6012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a68D2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5868
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5716
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a698E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6A39.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1804
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B24.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3656
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6BEF.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C8B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D37.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:3812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DF3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4828
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1892
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6EBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4652
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7073.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a713E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5016
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7209.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a72B5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a73A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1164
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a743C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a74E8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7594.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a768E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7759.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7824.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a78D0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4756
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4800
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a796C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5920
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A08.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7A95.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7B50.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7C2B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5848
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7DC1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E5E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5696
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7EEA.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2304
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F67.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1884
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7FD5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1840
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8061.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4812
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80DE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4604
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a816B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1988
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:6052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8207.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1916
                                                                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                                                                      30⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                      PID:768
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                        31⤵
                                                                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                                                                        PID:5060
                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                                                                          32⤵
                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                          PID:1660
                                                                                                                                                                                                                            • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                              C:\Windows\Logo1_.exe
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                              • Enumerates connected drives
                                                                                                                                                                                                                              • Drops file in Program Files directory
                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                              • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                              • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                              PID:2292
                                                                                                                                                                                                                              • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                PID:3348
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                  C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                    PID:5052
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                                  C:\Windows\SysWOW64\WerFault.exe -u -p 2292 -s 968
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                  • Program crash
                                                                                                                                                                                                                                  PID:5572
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                                                                                                              C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2292 -ip 2292
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:3772

                                                                                                                                                                                                                              Network

                                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                                    $$a2A6.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a2A6.bat
                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                    • SHA256 ea1cde56e8759df3a334d118cc632bede19f6e65a98b177def5d1b6d199e01b5
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$a65F.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$a65F.bat
                                                                                                                                                                                                                                    • Size 775B
                                                                                                                                                                                                                                    • SHA256 d4667491fbbe7bd4bea677720472ad0b29441a47c3be06534b6e8efefe8f768a
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aB62C.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB62C.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 7623652c8a946e0ae157810fb2ab5c4bef016ff1b7c4c8d7d4c759e4d50761d2
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aB958.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aB958.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 8c309c47a8a63e4a43f9cf25e8ab450a97761bdc296f8d0dce084ad6f71c1ed9
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aBD9E.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aBD9E.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 4840680af9080ca9d3b7b4355ee72f5b27e97525c0eef392161ea36960edb36b
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aC203.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC203.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 7588ac622af67c03aa938f4ced439a83b7346c7f9b1e7bcbf9c3b4c15330218a
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aC5AC.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC5AC.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 3b075a55d77a8f2ceee526beb7c7e1a63e1988e286df951c44b3647dfc65e904
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aC9B4.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aC9B4.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 ed06da4243301a6dd0095f5557e47f266d841838deb3fccc091382336d71d6d1
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aCFBF.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aCFBF.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 bdd6ff2da5e518bb202ea1af8b22ac0d2b496d090fe05871892cffdd2723bb73
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aD695.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aD695.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 ba73a5df2eedb862a7a9089228a3ca4bcbb649875380e2db9e3560ee4c155c53
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aDF8D.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aDF8D.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 467da1d27fb710e5e9c78d218d100c35702e5b2c5da14296d8cd97e3537958fa
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aE1C0.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE1C0.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 e1d6d44908a229fef4d8c42b3d98768a54edd23d9d8a7ca56718cd493c265d43
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aE951.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aE951.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 39363bbd7c1d24c707239e4b9ab6c3b44d787c50d2472c52918c5b8515d4d433
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aEEB0.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aEEB0.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 153e2cc3b2ac4d88c52c279e9ebdda3f74b133dd6b273be50c7cea46e74df432
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aF289.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aF289.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 d68d6048b5a0d0fb701ee1b0dd348dabf3dd271239278394da5e8deff0053370
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aF5E4.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aF5E4.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 2be5f7ef60d6cd1b2e0a340cf4df48e42a102f4cea909dbbfffb92fee3c86114
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aFBC0.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aFBC0.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 b1a83a1ca80437be13a1bd4c93aeb4befca43e462cbb35c28e2b344d59c85f03
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    $$aFE70.bat
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\$$aFE70.bat
                                                                                                                                                                                                                                    • Size 776B
                                                                                                                                                                                                                                    • SHA256 31752a61d89bacef54954114e8d43d2bab65c3f7e965231968233e24a49d5640
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                    • SHA256 db04cbb41d7b7ec6c30d9228cb11558d328c15930851ea91c460d43646752692
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                    • SHA256 f749b202679081e00ce447900349e3c4342b5c09982d52ba01cd8aa73b6026d7
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                    • SHA256 37ebee035a80ec6c81c0cbf1313e7bf3eb78a77e48e5c90e840386f36f2d8f08
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                    • SHA256 e6222670f1262123d14dc6006fdadd58d5bc19421e63adc114af0e19e4f44c86
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                    • SHA256 9d69d6d7613dc5774898c8b4410bce43f312e1cd3c6bfac4c9f6a32d6f6d0fd2
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                    • SHA256 840fa63ac53f9037817d87e58ee4a615b6e7d3acc04e0aa9302fccf8461c6a0b
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.1MB
                                                                                                                                                                                                                                    • SHA256 f8083a71e7a95552a8529cee9a54ef9a29447025118774de78bde0f5af8db77a
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                    • SHA256 a3b2cdadcb2ac3d7646278aa091c61b83918e148bdfa25c43570092bec839b36
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                    • SHA256 079638a96e301691c3749c05c6a42518f0565dae17ab42a5fde26a04ae675b6e
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.4MB
                                                                                                                                                                                                                                    • SHA256 6e86f4cb865755351b91afad502e126491bac2d840c06104adbf665d32245972
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                    • SHA256 45026f244fb3d41898de30b6349482303d35cb83c3fecf5491252457b727de4a
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.2MB
                                                                                                                                                                                                                                    • SHA256 a1268d09d557b0609e146f8a259ebfa21cda46c3d0a6df6475a0ab1696908193
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                    • SHA256 a6711bb276a82a7852afb7116ede59c60c2847d142e2858f0aa10675238a20c5
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.0MB
                                                                                                                                                                                                                                    • SHA256 1ee8e82d945f3addfed974e4a84164aac7f7ac52732806fb8cf5276c48729cdf
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                    • SHA256 c76b212b0072e2caa3b31029908301970d8ffbc07215636280bcc93ef31c56be
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                    • SHA256 d1061444976fb7c9508860e930ced8783b70268d428e314648d803cfa517ef8d
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 5.3MB
                                                                                                                                                                                                                                    • SHA256 b5b945d43af5450fbbd28ff142662b978817fba93a5ffdf9a44fea434ebfddfc
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                    • Size 4.9MB
                                                                                                                                                                                                                                    • SHA256 f731182731992dc60d46fc01ec339781b9b720631698a9e350e42485a4296d10
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Dll.dll
                                                                                                                                                                                                                                    • Path C:\Windows\Dll.dll
                                                                                                                                                                                                                                    • Size 68KB
                                                                                                                                                                                                                                    • SHA256 58902ae17338af4211e7e21eddb09671507b48740fa7056b9b7f7ab307da0168
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    Logo1_.exe
                                                                                                                                                                                                                                    • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                    • Size 32KB
                                                                                                                                                                                                                                    • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    _desktop.ini
                                                                                                                                                                                                                                    • Path F:\$RECYCLE.BIN\S-1-5-21-939655444-3071939294-1401108526-1000\_desktop.ini
                                                                                                                                                                                                                                    • Size 9B
                                                                                                                                                                                                                                    • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                    • MD5 SHA1 SHA512
                                                                                                                                                                                                                                    Submit Download

                                                                                                                                                                                                                                    memory/260-2166-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/664-6130-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/680-5979-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/688-6160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/732-5151-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/768-5653-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/768-5576-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/768-5526-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/868-5725-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1044-4309-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1068-5974-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1124-5969-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1164-6105-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1176-5563-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1200-5644-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1212-5733-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1276-5729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1300-5954-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1464-5746-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1696-5887-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1716-5811-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1728-5806-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1748-55-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1804-6044-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/1892-6069-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2080-6004-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2132-6135-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2160-5612-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2180-6054-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2196-6090-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2256-5882-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2268-10-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2268-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2292-5515-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2292-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2292-439-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2292-2153-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2348-5826-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2372-6019-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2380-6079-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2388-5801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2392-5741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2528-5673-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2536-5892-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2624-5580-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2684-5781-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2772-6009-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2840-5907-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2868-5939-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2904-2341-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/2956-5669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3076-5701-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3224-5857-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3248-5559-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3284-6100-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3308-30-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3368-5831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3424-443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3484-5756-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3552-5897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3604-5836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3612-5737-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3656-6049-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3660-5949-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3720-5571-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3728-5914-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3768-5665-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3812-6064-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3888-5786-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3904-5841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3928-5575-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3932-5648-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3960-5661-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/3972-5636-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4100-5552-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4124-17-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4124-21-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4224-5877-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4292-6120-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4300-5989-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4304-5984-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4324-44-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4340-5902-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4372-5588-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4400-5567-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4428-5652-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4444-65-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4480-1836-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4540-6095-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4640-5616-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4652-6074-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4716-5751-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4780-5821-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4800-6140-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4808-5909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4880-6125-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4888-5534-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4932-5231-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4944-5657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/4952-5924-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5124-6059-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5136-5816-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5156-5543-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5164-5584-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5184-5994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5208-5677-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5224-5761-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5228-5929-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5256-5592-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5264-5681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5280-5944-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5320-5766-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5328-5771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5344-6155-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5352-5919-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5356-6014-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5368-5685-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5400-5596-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5404-5934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5412-5600-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5416-6085-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5440-5862-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5452-6024-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5456-5693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5464-5846-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5480-5604-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5484-5999-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5536-5776-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5564-5697-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5588-5689-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5636-5851-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5644-5608-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5680-5721-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5684-5527-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5700-5640-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5716-6034-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5748-5039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5752-5709-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5764-5959-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5780-5620-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5800-5791-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5804-5867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5816-6170-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5836-5705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5848-6165-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5872-5964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5876-5872-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5912-6039-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5920-6145-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5944-5624-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5952-6110-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5956-5713-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5960-5796-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/5980-5628-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6012-6029-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6020-6175-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6048-6150-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6056-5717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6092-6115-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download

                                                                                                                                                                                                                                    memory/6124-5632-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                    Download