Overview

overview

7

Static

static

3

2026-09-30...op.exe

windows10-2004-x64

7

2026-09-30...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 12:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
  • Size 5.4MB
  • Sample260930-p5aa4azbnd
  • SHA256 98192071f126f594b39ab291036a97ac0236fbceae687694dbd000c5a58e0163
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Creates a file in the Startup directory 1 TTPs 2 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Executes dropped EXE 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Executes a command shell one-liner 1 TTPs 64 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4120
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE361.bat
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:2612
      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2700
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aE69D.bat
          4⤵
          • Executes a command shell one-liner
          • Suspicious use of WriteProcessMemory
          PID:3696
          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
            5⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:2596
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEAA4.bat
              6⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:4456
              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                7⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:264
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aEDD1.bat
                  8⤵
                  • Executes a command shell one-liner
                  • Suspicious use of WriteProcessMemory
                  PID:3036
                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                    9⤵
                    • Executes dropped EXE
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of WriteProcessMemory
                    PID:4364
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF0EE.bat
                      10⤵
                      • System Location Discovery: System Language Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:4132
                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                        11⤵
                        • Executes dropped EXE
                        • Drops file in Windows directory
                        • Suspicious use of WriteProcessMemory
                        PID:4652
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF468.bat
                          12⤵
                          • Executes a command shell one-liner
                          • Suspicious use of WriteProcessMemory
                          PID:1216
                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                            13⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:5948
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aF766.bat
                              14⤵
                              • Executes a command shell one-liner
                              • Suspicious use of WriteProcessMemory
                              PID:2440
                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                15⤵
                                • Executes dropped EXE
                                • System Location Discovery: System Language Discovery
                                • Suspicious use of WriteProcessMemory
                                PID:1796
                                • C:\Windows\SysWOW64\cmd.exe
                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a30E.bat
                                  16⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4940
                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                    17⤵
                                    • Executes dropped EXE
                                    • Suspicious use of WriteProcessMemory
                                    PID:4032
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a541.bat
                                      18⤵
                                      • Executes a command shell one-liner
                                      • Suspicious use of WriteProcessMemory
                                      PID:568
                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                        19⤵
                                        • Executes dropped EXE
                                        • Drops file in Windows directory
                                        • Suspicious use of WriteProcessMemory
                                        PID:4920
                                        • C:\Windows\SysWOW64\cmd.exe
                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB8A.bat
                                          20⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:2748
                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                            21⤵
                                            • Executes dropped EXE
                                            • Suspicious use of WriteProcessMemory
                                            PID:2292
                                            • C:\Windows\SysWOW64\cmd.exe
                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1B69.bat
                                              22⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:2404
                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                23⤵
                                                • Executes dropped EXE
                                                • Drops file in Windows directory
                                                • Suspicious use of WriteProcessMemory
                                                PID:4148
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a1F51.bat
                                                  24⤵
                                                  • Executes a command shell one-liner
                                                  • Suspicious use of WriteProcessMemory
                                                  PID:5232
                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                    25⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Windows directory
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3188
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a24CF.bat
                                                      26⤵
                                                      • Executes a command shell one-liner
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:5732
                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                        27⤵
                                                        • Executes dropped EXE
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:1108
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2665.bat
                                                          28⤵
                                                          • System Location Discovery: System Language Discovery
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1304
                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                            29⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Windows directory
                                                            • Suspicious use of WriteProcessMemory
                                                            PID:6052
                                                            • C:\Windows\SysWOW64\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2973.bat
                                                              30⤵
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:4304
                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                31⤵
                                                                • Executes dropped EXE
                                                                • Drops file in Windows directory
                                                                • System Location Discovery: System Language Discovery
                                                                • Suspicious use of WriteProcessMemory
                                                                PID:2672
                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a2C8F.bat
                                                                  32⤵
                                                                  • Executes a command shell one-liner
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:4424
                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                    33⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious use of WriteProcessMemory
                                                                    PID:4556
                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a38E4.bat
                                                                      34⤵
                                                                      • Suspicious use of WriteProcessMemory
                                                                      PID:4312
                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                        35⤵
                                                                        • Executes dropped EXE
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:5044
                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3A2C.bat
                                                                          36⤵
                                                                          • Suspicious use of WriteProcessMemory
                                                                          PID:5924
                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                            37⤵
                                                                            • Executes dropped EXE
                                                                            • Suspicious use of WriteProcessMemory
                                                                            PID:1628
                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3D0A.bat
                                                                              38⤵
                                                                              • Executes a command shell one-liner
                                                                              • Suspicious use of WriteProcessMemory
                                                                              PID:4728
                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                39⤵
                                                                                • Executes dropped EXE
                                                                                • Suspicious use of WriteProcessMemory
                                                                                PID:1856
                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a3FC9.bat
                                                                                  40⤵
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:4668
                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                    41⤵
                                                                                    • Executes dropped EXE
                                                                                    • Drops file in Windows directory
                                                                                    • Suspicious use of WriteProcessMemory
                                                                                    PID:2420
                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4288.bat
                                                                                      42⤵
                                                                                      • Executes a command shell one-liner
                                                                                      • Suspicious use of WriteProcessMemory
                                                                                      PID:4076
                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                        43⤵
                                                                                        • Executes dropped EXE
                                                                                        • Drops file in Windows directory
                                                                                        • Suspicious use of WriteProcessMemory
                                                                                        PID:4212
                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4528.bat
                                                                                          44⤵
                                                                                          • Executes a command shell one-liner
                                                                                          • Suspicious use of WriteProcessMemory
                                                                                          PID:5136
                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                            45⤵
                                                                                            • Executes dropped EXE
                                                                                            • Suspicious use of WriteProcessMemory
                                                                                            PID:1172
                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4661.bat
                                                                                              46⤵
                                                                                              • Executes a command shell one-liner
                                                                                              • Suspicious use of WriteProcessMemory
                                                                                              PID:4796
                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                47⤵
                                                                                                • Executes dropped EXE
                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                PID:2680
                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a475B.bat
                                                                                                  48⤵
                                                                                                  • Executes a command shell one-liner
                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                  PID:5784
                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                    49⤵
                                                                                                    • Executes dropped EXE
                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                    PID:5148
                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4845.bat
                                                                                                      50⤵
                                                                                                      • Executes a command shell one-liner
                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                      PID:2500
                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                        51⤵
                                                                                                        • Executes dropped EXE
                                                                                                        • Drops file in Windows directory
                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                        PID:4224
                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4920.bat
                                                                                                          52⤵
                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                          PID:2580
                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                            53⤵
                                                                                                            • Executes dropped EXE
                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                            PID:5508
                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4A0A.bat
                                                                                                              54⤵
                                                                                                              • Suspicious use of WriteProcessMemory
                                                                                                              PID:2968
                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                55⤵
                                                                                                                • Executes dropped EXE
                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                PID:4960
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4B04.bat
                                                                                                                  56⤵
                                                                                                                  • Suspicious use of WriteProcessMemory
                                                                                                                  PID:1164
                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                    57⤵
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops file in Windows directory
                                                                                                                    • Suspicious use of WriteProcessMemory
                                                                                                                    PID:2804
                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4BEF.bat
                                                                                                                      58⤵
                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                      PID:1444
                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                        59⤵
                                                                                                                        • Executes dropped EXE
                                                                                                                        • Drops file in Windows directory
                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                        PID:3040
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4CC9.bat
                                                                                                                          60⤵
                                                                                                                          • Executes a command shell one-liner
                                                                                                                          • Suspicious use of WriteProcessMemory
                                                                                                                          PID:2772
                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                            61⤵
                                                                                                                            • Executes dropped EXE
                                                                                                                            • Suspicious use of WriteProcessMemory
                                                                                                                            PID:4844
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4DE3.bat
                                                                                                                              62⤵
                                                                                                                              • Executes a command shell one-liner
                                                                                                                              PID:4620
                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                63⤵
                                                                                                                                • Executes dropped EXE
                                                                                                                                • Drops file in Windows directory
                                                                                                                                PID:5020
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4EEC.bat
                                                                                                                                  64⤵
                                                                                                                                    PID:2584
                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                      65⤵
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      PID:2380
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a4FD7.bat
                                                                                                                                        66⤵
                                                                                                                                          PID:3764
                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                            67⤵
                                                                                                                                            • Executes dropped EXE
                                                                                                                                            • Drops file in Windows directory
                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                            PID:4732
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a50B1.bat
                                                                                                                                              68⤵
                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                              PID:1784
                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                69⤵
                                                                                                                                                • Executes dropped EXE
                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                PID:2164
                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a51AB.bat
                                                                                                                                                  70⤵
                                                                                                                                                    PID:6056
                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                      71⤵
                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                      PID:2576
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5296.bat
                                                                                                                                                        72⤵
                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                        PID:3816
                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                          73⤵
                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                          PID:2904
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5380.bat
                                                                                                                                                            74⤵
                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                            PID:1516
                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                              75⤵
                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                              PID:2840
                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a546B.bat
                                                                                                                                                                76⤵
                                                                                                                                                                  PID:4308
                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                    77⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                    PID:4612
                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a55E2.bat
                                                                                                                                                                      78⤵
                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                      PID:4216
                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                        79⤵
                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                        PID:2524
                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a56BC.bat
                                                                                                                                                                          80⤵
                                                                                                                                                                            PID:3108
                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                              81⤵
                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                              PID:3284
                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5778.bat
                                                                                                                                                                                82⤵
                                                                                                                                                                                  PID:3208
                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                    83⤵
                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                    PID:1220
                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5853.bat
                                                                                                                                                                                      84⤵
                                                                                                                                                                                        PID:4580
                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                          85⤵
                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                          PID:6012
                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a596C.bat
                                                                                                                                                                                            86⤵
                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                            PID:2456
                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                              87⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                              PID:1276
                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5A56.bat
                                                                                                                                                                                                88⤵
                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                PID:2884
                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                  89⤵
                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                  PID:2568
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5B21.bat
                                                                                                                                                                                                    90⤵
                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                    PID:2920
                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                      91⤵
                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                      PID:460
                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5C4A.bat
                                                                                                                                                                                                        92⤵
                                                                                                                                                                                                          PID:1512
                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                            93⤵
                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                            PID:3312
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5D54.bat
                                                                                                                                                                                                              94⤵
                                                                                                                                                                                                                PID:3704
                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                  95⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  PID:4860
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5E2F.bat
                                                                                                                                                                                                                    96⤵
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    PID:1152
                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                      97⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                      PID:5680
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5F09.bat
                                                                                                                                                                                                                        98⤵
                                                                                                                                                                                                                          PID:5004
                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                            99⤵
                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                            PID:260
                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a5FF4.bat
                                                                                                                                                                                                                              100⤵
                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                              PID:4760
                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                101⤵
                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                PID:1688
                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a60CE.bat
                                                                                                                                                                                                                                  102⤵
                                                                                                                                                                                                                                    PID:4660
                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                      103⤵
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      PID:4168
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a61E8.bat
                                                                                                                                                                                                                                        104⤵
                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                        PID:4316
                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                          105⤵
                                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                                          PID:4432
                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a62D2.bat
                                                                                                                                                                                                                                            106⤵
                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                            PID:2972
                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                              107⤵
                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                              PID:3212
                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a63CC.bat
                                                                                                                                                                                                                                                108⤵
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                PID:2876
                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                  109⤵
                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                  PID:1636
                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a64C6.bat
                                                                                                                                                                                                                                                    110⤵
                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                    PID:2128
                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                      111⤵
                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                      PID:3804
                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6591.bat
                                                                                                                                                                                                                                                        112⤵
                                                                                                                                                                                                                                                          PID:3324
                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                            113⤵
                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                            PID:1336
                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a666C.bat
                                                                                                                                                                                                                                                              114⤵
                                                                                                                                                                                                                                                                PID:1732
                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                  115⤵
                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                  PID:1868
                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6747.bat
                                                                                                                                                                                                                                                                    116⤵
                                                                                                                                                                                                                                                                      PID:4400
                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                        117⤵
                                                                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                                                                        PID:5880
                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6841.bat
                                                                                                                                                                                                                                                                          118⤵
                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                          PID:3396
                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                            119⤵
                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                            PID:3256
                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a692B.bat
                                                                                                                                                                                                                                                                              120⤵
                                                                                                                                                                                                                                                                                PID:2632
                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                  121⤵
                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                  PID:4368
                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a69F6.bat
                                                                                                                                                                                                                                                                                    122⤵
                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                    PID:1240
                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                      123⤵
                                                                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                                                                      PID:5108
                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6AC1.bat
                                                                                                                                                                                                                                                                                        124⤵
                                                                                                                                                                                                                                                                                          PID:2024
                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                            125⤵
                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                            PID:3184
                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6B7D.bat
                                                                                                                                                                                                                                                                                              126⤵
                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                              PID:2096
                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                127⤵
                                                                                                                                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                PID:4088
                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6C48.bat
                                                                                                                                                                                                                                                                                                  128⤵
                                                                                                                                                                                                                                                                                                    PID:1436
                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                      129⤵
                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                      PID:204
                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6D13.bat
                                                                                                                                                                                                                                                                                                        130⤵
                                                                                                                                                                                                                                                                                                          PID:1572
                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                            131⤵
                                                                                                                                                                                                                                                                                                              PID:4404
                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6DCF.bat
                                                                                                                                                                                                                                                                                                                132⤵
                                                                                                                                                                                                                                                                                                                  PID:3288
                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                    133⤵
                                                                                                                                                                                                                                                                                                                      PID:5188
                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6ED8.bat
                                                                                                                                                                                                                                                                                                                        134⤵
                                                                                                                                                                                                                                                                                                                          PID:2996
                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                            135⤵
                                                                                                                                                                                                                                                                                                                              PID:3616
                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a6FB3.bat
                                                                                                                                                                                                                                                                                                                                136⤵
                                                                                                                                                                                                                                                                                                                                  PID:3700
                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                    137⤵
                                                                                                                                                                                                                                                                                                                                      PID:3888
                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a70BD.bat
                                                                                                                                                                                                                                                                                                                                        138⤵
                                                                                                                                                                                                                                                                                                                                          PID:4260
                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                            139⤵
                                                                                                                                                                                                                                                                                                                                              PID:4012
                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7197.bat
                                                                                                                                                                                                                                                                                                                                                140⤵
                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                PID:3296
                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                  141⤵
                                                                                                                                                                                                                                                                                                                                                    PID:4004
                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7282.bat
                                                                                                                                                                                                                                                                                                                                                      142⤵
                                                                                                                                                                                                                                                                                                                                                        PID:3996
                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                          143⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1808
                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a735C.bat
                                                                                                                                                                                                                                                                                                                                                              144⤵
                                                                                                                                                                                                                                                                                                                                                                PID:4164
                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                  145⤵
                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                  PID:5388
                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7447.bat
                                                                                                                                                                                                                                                                                                                                                                    146⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:6036
                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                        147⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:6080
                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7512.bat
                                                                                                                                                                                                                                                                                                                                                                            148⤵
                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                            PID:5124
                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                              149⤵
                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                              PID:2316
                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a75ED.bat
                                                                                                                                                                                                                                                                                                                                                                                150⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:5156
                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                    151⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                    PID:2088
                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a76C7.bat
                                                                                                                                                                                                                                                                                                                                                                                      152⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                      PID:4984
                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                        153⤵
                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                        PID:2836
                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a77E1.bat
                                                                                                                                                                                                                                                                                                                                                                                          154⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:4696
                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                              155⤵
                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                              PID:596
                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7CA3.bat
                                                                                                                                                                                                                                                                                                                                                                                                156⤵
                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                PID:4536
                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                  157⤵
                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                  PID:5184
                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7D4F.bat
                                                                                                                                                                                                                                                                                                                                                                                                    158⤵
                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                    PID:5452
                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                      159⤵
                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                      PID:4140
                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7E2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                        160⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                            161⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                            PID:2924
                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a7F14.bat
                                                                                                                                                                                                                                                                                                                                                                                                              162⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:2756
                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                  163⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a802E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                      164⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2716
                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                        165⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3408
                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a80E9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                          166⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5460
                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                            167⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4544
                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a81B4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                168⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2148
                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                  169⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5024
                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8260.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                    170⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3856
                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                      171⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5984
                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a830C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                          172⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3112
                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                              173⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1656
                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a83A8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                174⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4564
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    175⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5828
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8454.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                        176⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2180
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            177⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:2820
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a84F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                178⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    179⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a858D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      180⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        181⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8639.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          182⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            183⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1556
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a86F4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                184⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    185⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a87A0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        186⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          187⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a883C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            188⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              189⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a88F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                190⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    191⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a89F2.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      192⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          193⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8A9E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            194⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                195⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5688
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8B2A.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  196⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1600
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    197⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8C05.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      198⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4156
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        199⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8CA1.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            200⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4916
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              201⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8D5D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  202⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      203⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8E18.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          204⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            205⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8EB4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                206⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:2572
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  207⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4912
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a8F70.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      208⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        209⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1496
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a901C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          210⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2480
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            211⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1564
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a90C8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              212⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1476
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                213⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4992
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9174.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    214⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1820
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      215⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a922F.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        216⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            217⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a92DB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              218⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  219⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9396.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      220⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2724
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        221⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9481.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          222⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:832
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            223⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a952D.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              224⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  225⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a95B9.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    226⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5640
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        227⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5596
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9665.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          228⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            229⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3468
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9701.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                230⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  231⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a97CD.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    232⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      233⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9869.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        234⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4332
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            235⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9915.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                236⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  237⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a99E0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      238⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          239⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2844
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9ABB.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              240⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:6044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                241⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2560
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9B66.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    242⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:5928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      243⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9C03.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          244⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:5964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              245⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9CBE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  246⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3612
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      247⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9D3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        248⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:836
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          249⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1764
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9DD7.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            250⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                251⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9E74.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    252⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:3692
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      253⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2740
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9F20.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          254⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              255⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5144
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$a9FAC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  256⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    257⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4500
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA048.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      258⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        259⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5860
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA0E5.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            260⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              261⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:6060
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA191.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  262⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:5112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    263⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA24C.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        264⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:3236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          265⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA2F8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            266⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                267⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA3C3.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    268⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6092
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      269⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA450.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        270⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5856
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            271⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4492
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA4DC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              272⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3020
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  273⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2616
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA579.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    274⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      275⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA644.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          276⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4636
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            277⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:8
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA6F0.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                278⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:3024
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  279⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4244
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA79B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      280⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:6088
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        281⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4084
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA847.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            282⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:2336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              283⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4948
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA8D4.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  284⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4588
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    285⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aA980.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      286⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:4676
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        287⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:3344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAA3B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            288⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                289⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4880
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAAD8.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    290⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:2808
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      291⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:5432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAB64.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          292⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:3012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              293⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:4736
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAC10.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                294⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:3576
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    295⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:2732
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aACBC.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        296⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:2816
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          297⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:2664
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAD68.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            298⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:4768
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              299⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAE43.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  300⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:4624
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      301⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAEEE.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          302⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:5720
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            303⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:3620
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aAF7B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                304⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:5648
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  305⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB008.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      306⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:4040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          307⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB085.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              308⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:4052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  309⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:2528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB102.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    310⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:5684
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        311⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:4632
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB19E.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            312⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:5908
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                313⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:4952
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\$$aB22B.bat
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    314⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Executes a command shell one-liner
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:6008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      315⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1768
                                                                                                                                                                                                                                    • C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                      C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • Creates a file in the Startup directory
                                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                                      • Enumerates connected drives
                                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                                      • Reads the TCP/IP host and domain name from the registry
                                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                      • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                      PID:2556
                                                                                                                                                                                                                                      • C:\Windows\SysWOW64\net.exe
                                                                                                                                                                                                                                        net stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                        • Suspicious use of WriteProcessMemory
                                                                                                                                                                                                                                        PID:3500
                                                                                                                                                                                                                                        • C:\Windows\SysWOW64\net1.exe
                                                                                                                                                                                                                                          C:\Windows\system32\net1 stop "Kingsoft AntiVirus Service"
                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                            PID:2680

                                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                                          MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                          Reconnaissance

                                                                                                                                                                                                                                          Resource Development

                                                                                                                                                                                                                                          Initial Access

                                                                                                                                                                                                                                          Execution

                                                                                                                                                                                                                                          Command and Scripting Interpreter

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1059

                                                                                                                                                                                                                                          Windows Command Shell

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1059.003

                                                                                                                                                                                                                                          Persistence

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Privilege Escalation

                                                                                                                                                                                                                                          Boot or Logon Autostart Execution

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547

                                                                                                                                                                                                                                          Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1547.001

                                                                                                                                                                                                                                          Defense Evasion

                                                                                                                                                                                                                                          Credential Access

                                                                                                                                                                                                                                          Credentials from Password Stores

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1555

                                                                                                                                                                                                                                          Credentials from Web Browsers

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1555.003

                                                                                                                                                                                                                                          Unsecured Credentials

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1552

                                                                                                                                                                                                                                          Credentials In Files

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1552.001

                                                                                                                                                                                                                                          Discovery

                                                                                                                                                                                                                                          Peripheral Device Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1120

                                                                                                                                                                                                                                          Query Registry

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1012

                                                                                                                                                                                                                                          System Information Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1082

                                                                                                                                                                                                                                          System Location Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1614

                                                                                                                                                                                                                                          System Language Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1614.001

                                                                                                                                                                                                                                          System Network Configuration Discovery

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1016

                                                                                                                                                                                                                                          Lateral Movement

                                                                                                                                                                                                                                          Collection

                                                                                                                                                                                                                                          Data from Local System

                                                                                                                                                                                                                                          1
                                                                                                                                                                                                                                          T1005

                                                                                                                                                                                                                                          Command and Control

                                                                                                                                                                                                                                          Exfiltration

                                                                                                                                                                                                                                          Impact

                                                                                                                                                                                                                                          Replay Monitor

                                                                                                                                                                                                                                          Loading Replay Monitor...

                                                                                                                                                                                                                                          Downloads

                                                                                                                                                                                                                                          $$a1B69.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a1B69.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 750acd5621ee553ccbe0b18c831b999f49f544eb2f9f37fa9ffe09671c6e8106
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a1F51.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a1F51.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 ac96806c37c818199a9d3104437b973640509457e290158862ba9108d7bb2fe2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a24CF.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a24CF.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 35af1f62fee3d594bb6e33e307b92acce8fc1191766453fac4ca0624c1427f95
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a2665.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2665.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 be0da79fd12e7999c24d39fce8c871ca098b7550e839634759e4cba8479f3672
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a2973.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2973.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 9704f70e25ee693bdcf28691e7182d2d5d6f3de67328b1242d2ca96967c5222c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a2C8F.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a2C8F.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 4659a6ad06a08cbe4ae94fa4d629b67b7cfa7de5b5a6b534d62e50b9e88ec467
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a30E.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a30E.bat
                                                                                                                                                                                                                                          • Size 775B
                                                                                                                                                                                                                                          • SHA256 6393b2e4bc0aaa377615ff52758e11706269ae891650f49985de5a5172647f70
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a38E4.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a38E4.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 874222362e4a74addb933f943ac965d98589f3818b37366bc3b3bf3a5201b4e1
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a3A2C.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3A2C.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 4e5589ac8cd07893fde7f5316c0ce9dd736e44dbdfcc68d8323a573d44009c90
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a3D0A.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3D0A.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 0cbbc6b5a34a042e44c911f5a0ef73627c060d52393eac33ba0761b0264863a9
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a3FC9.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a3FC9.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 755c0114b6dfecfa66924e9ae0cdffbc8a4024486a247f72ea8bad782c2a7216
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a4288.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a4288.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 69538fb729f8f5f29c3144bbd0b83aa1addc8926f531eff76e2cfc01bf4278e8
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$a541.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$a541.bat
                                                                                                                                                                                                                                          • Size 775B
                                                                                                                                                                                                                                          • SHA256 e308d12d28bd97ca31211865240b1d8270d5fd5effe9d5bc0ab404aeeaa0400f
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$aB8A.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aB8A.bat
                                                                                                                                                                                                                                          • Size 775B
                                                                                                                                                                                                                                          • SHA256 cc6dd5c2ba806c257a06ea732ea10a061f122f872fc0e88d56dbf1182fbe3636
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$aE361.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE361.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 e5d7c7878b787c7f78d2f94ff27fb32d47adc482541dab6501a0d2429d952d59
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$aE69D.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aE69D.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 40164fc281ea62c1a08fe0d43b6da7376ea8e72b37ce427ceef73796f1daf4aa
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$aEAA4.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEAA4.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 c55f92ff52b19507ae94e8cdadf93321692d64f0195f59cfce441f65942cf68b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$aEDD1.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aEDD1.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 2a3cd2cd1cc89a6b82a9fa37bd68e85777f692f4e65575bd80b0c15fd01d0be0
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$aF0EE.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF0EE.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 6cd80964a68cde84172f9fce15e28abecac7ba58447f489cefe1fb6677306d86
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$aF468.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF468.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 1afac55b9130dfe717408bf3eae0feabe86e1b3001822a46dca5d52d3ce520fe
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          $$aF766.bat
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\$$aF766.bat
                                                                                                                                                                                                                                          • Size 776B
                                                                                                                                                                                                                                          • SHA256 41f00b08ca7db6cab8cea451b02fc25e5b6b170bb65e3f07b0336fb4a3725aab
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                          • SHA256 840fa63ac53f9037817d87e58ee4a615b6e7d3acc04e0aa9302fccf8461c6a0b
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                          • SHA256 f8083a71e7a95552a8529cee9a54ef9a29447025118774de78bde0f5af8db77a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                          • SHA256 a6711bb276a82a7852afb7116ede59c60c2847d142e2858f0aa10675238a20c5
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                          • SHA256 a3b2cdadcb2ac3d7646278aa091c61b83918e148bdfa25c43570092bec839b36
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 4.9MB
                                                                                                                                                                                                                                          • SHA256 c76b212b0072e2caa3b31029908301970d8ffbc07215636280bcc93ef31c56be
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                          • SHA256 9d69d6d7613dc5774898c8b4410bce43f312e1cd3c6bfac4c9f6a32d6f6d0fd2
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.0MB
                                                                                                                                                                                                                                          • SHA256 1ee8e82d945f3addfed974e4a84164aac7f7ac52732806fb8cf5276c48729cdf
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 4.8MB
                                                                                                                                                                                                                                          • SHA256 608c0fd0eebf05cde57222ebfc856d73449d9e7c36bc59747f6a29392732b22c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.2MB
                                                                                                                                                                                                                                          • SHA256 37ebee035a80ec6c81c0cbf1313e7bf3eb78a77e48e5c90e840386f36f2d8f08
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 4.9MB
                                                                                                                                                                                                                                          • SHA256 f731182731992dc60d46fc01ec339781b9b720631698a9e350e42485a4296d10
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 4.9MB
                                                                                                                                                                                                                                          • SHA256 45026f244fb3d41898de30b6349482303d35cb83c3fecf5491252457b727de4a
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 4.8MB
                                                                                                                                                                                                                                          • SHA256 1c4aa7163c51346a31f76a139840866cde15bfd13ae90304ded48f653d324d6c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                          • SHA256 db04cbb41d7b7ec6c30d9228cb11558d328c15930851ea91c460d43646752692
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                          • SHA256 079638a96e301691c3749c05c6a42518f0565dae17ab42a5fde26a04ae675b6e
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.2MB
                                                                                                                                                                                                                                          • SHA256 a1268d09d557b0609e146f8a259ebfa21cda46c3d0a6df6475a0ab1696908193
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.2MB
                                                                                                                                                                                                                                          • SHA256 f749b202679081e00ce447900349e3c4342b5c09982d52ba01cd8aa73b6026d7
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                          • SHA256 d1061444976fb7c9508860e930ced8783b70268d428e314648d803cfa517ef8d
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.1MB
                                                                                                                                                                                                                                          • SHA256 e6222670f1262123d14dc6006fdadd58d5bc19421e63adc114af0e19e4f44c86
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.4MB
                                                                                                                                                                                                                                          • SHA256 6e86f4cb865755351b91afad502e126491bac2d840c06104adbf665d32245972
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Path C:\Users\Admin\AppData\Local\Temp\2026-09-30_27c252a62d1ba7d6f3fdbf8bc3026dd7_amadey_elex_smoke-loader_stop.exe.exe
                                                                                                                                                                                                                                          • Size 5.3MB
                                                                                                                                                                                                                                          • SHA256 b5b945d43af5450fbbd28ff142662b978817fba93a5ffdf9a44fea434ebfddfc
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          Logo1_.exe
                                                                                                                                                                                                                                          • Path C:\Windows\Logo1_.exe
                                                                                                                                                                                                                                          • Size 32KB
                                                                                                                                                                                                                                          • SHA256 5c6ca16525876afba9f88ae6809b550793501ed5c5a73b8a800d4029ff92c98c
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          _desktop.ini
                                                                                                                                                                                                                                          • Path F:\$RECYCLE.BIN\S-1-5-21-4154726816-2055034831-2297277433-1000\_desktop.ini
                                                                                                                                                                                                                                          • Size 9B
                                                                                                                                                                                                                                          • SHA256 3b01728e72b5e4110a11234d4a111c8b841e7780c44559315123bbe0fbe10b97
                                                                                                                                                                                                                                          • MD5 SHA1 SHA512
                                                                                                                                                                                                                                          Submit Download

                                                                                                                                                                                                                                          memory/8-8921-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/204-8476-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/260-8398-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/264-48-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/432-8783-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/460-8378-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/596-8554-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1096-8645-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1108-6055-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1172-8260-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1220-8357-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1276-8368-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1300-8988-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1320-8741-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1336-8433-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1380-8579-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1496-8717-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1536-8789-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1540-8687-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1556-8639-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1564-8723-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1628-8233-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1636-8423-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1656-8609-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1688-8403-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1764-8837-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1796-1841-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1808-8518-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1856-8241-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1868-8438-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1880-8831-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/1976-8735-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2032-8801-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2088-8542-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2164-8322-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2232-8819-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2272-8699-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2292-5160-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2308-8663-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2316-8536-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2380-8312-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2420-8249-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2524-8347-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2536-8946-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2544-8915-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2556-2362-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2556-12-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2556-8358-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2556-1840-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2556-7196-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2560-8813-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2568-8373-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2576-8327-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-2376-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2596-34-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2616-8909-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2636-8693-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2664-8982-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2672-8261-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2672-6075-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2680-8266-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2700-23-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2732-8976-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2740-8849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2804-8292-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2820-8621-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2836-8548-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2840-8337-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2844-8807-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2860-8753-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2904-8332-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/2924-8572-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3040-8297-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3184-8464-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3188-6047-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3212-8418-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3256-8448-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3284-8352-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3312-8383-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3344-8952-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3408-8585-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3468-8777-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3616-8494-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3804-8428-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3880-8657-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3888-8500-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/3968-8681-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4004-8512-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4012-8506-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4024-8627-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4032-1849-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4084-8934-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4088-8470-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4104-8843-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4120-11-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4120-0-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4136-8891-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4140-8566-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4148-5578-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4168-8408-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4192-8705-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4212-8255-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4224-8276-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4228-8651-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4244-8928-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4292-8633-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4320-8759-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4336-8879-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4364-60-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4368-8453-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4392-8825-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4404-8482-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4408-8795-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4432-8413-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4492-8903-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4500-8861-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4544-8591-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4556-8215-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4612-8342-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4652-70-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4732-8317-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4736-8970-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4844-8302-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4860-8388-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4880-8958-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4912-8711-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4920-2468-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4928-8994-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4948-8940-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4960-8287-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/4992-8729-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5020-8307-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5024-8597-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5044-8223-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5044-8282-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5108-8458-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5140-8747-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5144-8855-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5148-8271-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5184-8560-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5188-8488-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5256-8765-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5368-8885-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5388-8524-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5416-8669-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5432-8964-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5508-8281-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5596-8771-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5624-8897-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5680-8393-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5688-8675-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5828-8615-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5860-8867-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5880-8443-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5948-78-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/5984-8603-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/6012-8363-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/6052-6067-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/6060-8873-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download

                                                                                                                                                                                                                                          memory/6080-8530-0x0000000000400000-0x0000000000445000-memory.dmp
                                                                                                                                                                                                                                          Download